Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107837— RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling

Quick assessment

Affected
RIOT-OS RIOT
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RIOT 是一个开源的微控制器操作系统，专为物联网设备和嵌入式系统而设计。在 2026.07 及更早版本中，位于 文件中的 函数在仅进行少量有效载荷检查后，可以将一个尺寸过小的数据包路由到 SFF（Short Frame Fragment）分片处理流程中。随后，代码将该数据包解释为 或更大的分片头结构，但未验证数据包片段（snip）是否包含所需的字节。远程攻击者可以发送一个构造畸形的 6LoWPAN 分片数据包，导致 函数越界读取数据包缓冲区，从而可能泄露内存信息并导致网络协议栈崩溃。截至本次审查时，尚未发布任何修

CVSS 8.2 · High

Possible ATT&CK Techniques 2 AI

T1044 T1115 · Clipboard Data

Affected Version Matrix 1

VendorProduct Version RangeStatus
RIOT-OS RIOT <= 2026.07 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107837

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling
Source: CVE Program / CVE List V5
Vulnerability Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
RIOT-OS RIOT <= 2026.07 -

II. Public POCs for CVE-2026-107837

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107837

请登录查看更多情报信息。

Other References for CVE-2026-107837 (3)

Same Patch Batch · RIOT-OS · 2026-10-09 · 3 CVEs total

CVE-2026-107838 7.5 HIGH RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable as
CVE-2026-107836 7.1 HIGH RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled b

IV. Related Vulnerabilities

Same product: RIOT
Same vendor: RIOT-OS
Same weakness: CWE-125

V. Comments for CVE-2026-107837

No comments yet

Leave a comment