CVE-2026-107836: RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoapsockgetslice() in sys/net/applicationlayer/nanocoap/sock.c accepts a Block2 response when blockcb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in 2bufslice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
RIOT 2026.07 and earlier are affected where the nanoCoAP client uses nanocoap_sock_get_slice() to retrieve Block2 responses from a CoAP server.
What does an attacker need to exploit this?
The attacker needs to control or act as the CoAP server responding to the client. They must return the expected Block2 block number while supplying a larger server-controlled block size that makes the derived offset exceed the requested slice offset.
Is a fixed RIOT release available?
No fixed release was available as of this review. The referenced advisory, pull request, and commit identify the upstream remediation work.