CVE-2026-107837: RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, receive() in sys/net/gnrc/networklayer/sixlowpan/gnrcsixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpanfragt or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrcsixlowpanfragrecv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
RIOT OS deployments using version 2026.07 or earlier are affected when they process 6LoWPAN SFF fragments. The vulnerable code is in the GNRC 6LoWPAN network-layer receive path.
What does an attacker need to exploit it?
An attacker can exploit the issue remotely by sending a malformed 6LoWPAN fragment with an undersized packet payload. No privileges or user interaction are required.
What is the likely impact of successful exploitation?
The out-of-bounds read can disclose memory and can crash the network stack, causing a denial of service.
Is a fixed RIOT OS release available?
No fixed repository release was available as of the review. The provided references include a pull request and commit associated with the issue.