Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-49868— RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

Quick assessment

Affected
RIOT-OS RIOT
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RIOT 是一个专为物联网设备及其他嵌入式系统设计的开源微控制器操作系统。在 2026.07 版本之前， 中的 函数在将 IA_PD 和 IA_NA 选项体传递给子选项解析器之前，未执行最小长度校验。当启用了 模块时，恶意或已被攻陷的 DHCPv6 服务器可发送一个选项长度小于所需结构体长度的 REPLY 报文，导致 函数读取超出选项体范围，引发 下溢，并造成无界越界堆读取。该漏洞可能导致设备崩溃，并可能暴露或破坏内存。此问题已在 2026.07 版本中修复。

CVSS 9.8 · Critical EPSS 0.37% · P30

Affected Version Matrix 1

VendorProduct Version RangeStatus
RIOT-OS RIOT < 2026.07 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49868

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read
Source: CVE Program / CVE List V5
Vulnerability Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
RIOT-OS RIOT < 2026.07 -

II. Public POCs for CVE-2026-49868

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49868

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-49868 (2)

Vendor Advisories for CVE-2026-49868 (1)

Vendor Pages for CVE-2026-49868 (1)

Same Patch Batch · RIOT-OS · 2026-10-16 · 3 CVEs total

CVE-2026-102693 9.6 CRITICAL RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID
CVE-2026-102692 9.1 CRITICAL RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memo

IV. Related Vulnerabilities

Same product: RIOT
Same vendor: RIOT-OS
Same weakness: CWE-125

V. Comments for CVE-2026-49868

No comments yet

Leave a comment