Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102692— RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access

Quick assessment

Affected
RIOT-OS RIOT
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RIOT 是一个专为物联网设备及其他嵌入式系统设计开源的微控制器操作系统。在 2026.07 版本之前，nanocoap 模块会接受超出限制的 CoAP Block2 选项值，而未强制执行 20 位最大块编号的限制，导致在 32 位目标平台上发生块偏移乘法溢出。受影响的 master 基线提交为 aeeae69e；已验证的修复方案已合并至 master 分支，但尚未发布。该超大数值会从 coap_get_blockopt() 传递至 coap_block_slicer_init()。远程 CoAP 客户端可发送畸形

CVSS 9.1 · Critical EPSS 0.35% · P27

Affected Version Matrix 1

VendorProduct Version RangeStatus
RIOT-OS RIOT < 2026.07 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102692

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access
Source: CVE Program / CVE List V5
Vulnerability Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
RIOT-OS RIOT < 2026.07 -

II. Public POCs for CVE-2026-102692

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102692

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-102692 (2)

Vendor Advisories for CVE-2026-102692 (1)

Vendor Pages for CVE-2026-102692 (1)

Same Patch Batch · RIOT-OS · 2026-10-16 · 3 CVEs total

CVE-2026-49868 9.8 CRITICAL RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underfl
CVE-2026-102693 9.6 CRITICAL RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID

IV. Related Vulnerabilities

Same product: RIOT
Same vendor: RIOT-OS
Same weakness: CWE-190

V. Comments for CVE-2026-102692

No comments yet

Leave a comment