CVE-2026-102692
9.1CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-190, CWE-787
Impact
Remote unauthenticated attackers can crash devices or corrupt memory by sending malformed CoAP packets over the network. They only need network reachability to the exposed nanocoap service.
Root cause
The nanocoap library fails to enforce the 20-bit limit on CoAP Block2 option values, causing an integer overflow during block offset multiplication on 32-bit targets.
Affected systems
RIOT versions prior to 2026.07 (including commit aeeae69e on master).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Fix & remediation
Upgrade RIOT OS to version 2026.07 or backport commit 6b283ace3565d931b3edff7e115d4f79339253b8 and ee1fa0ef91874494823d476392572aeefdbc6b74. If rebuilding firmware immediately is not possible, restrict or firewall incoming CoAP network traffic to trusted sources.
$ git checkout 2026.07AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.