CVE-2026-102692: RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coapgetblockopt() to coapblockslicerinit(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RIOT nanocoapto a version that resolves this vulnerability.Fixed in 2026.07
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
RIOT deployments using nanocoap on 32-bit targets are exposed if they are running a version prior to 2026.07 or the affected master baseline at commit aeeae69e. The vulnerable code processes CoAP Block2 options.
What does an attacker need to exploit it?
An attacker only needs network access to act as a remote CoAP client and send a malformed, oversized Block2 option. No privileges or user interaction are required.
Is an immediate upgrade available?
Yes. The issue is fixed in RIOT 2026.07. A verified fix is also present in master after the affected baseline, although it was described as unreleased before the 2026.07 release.
What is the impact if exploitation succeeds?
The oversized Block2 value can overflow block-offset multiplication, creating an invalid slice range. This can result in out-of-bounds memory access, denial of service, or memory corruption.