CVE-2026-25139: RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to read adjacent memory locations, or crash a vulnerable device running the 6LoWPAN stack. The received packet is cast into a sixlowpansfrrfragt struct and dereferenced without validating the packet is large enough to contain the struct object. At time of publication, no known patch exists.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25139?
CVE-2026-25139 is classified as a high-severity vulnerability due to potential compromise of system integrity.
How do I fix CVE-2026-25139?
To fix CVE-2026-25139, upgrade to RIOT version 2025.11 or later that addresses the out-of-bounds read vulnerabilities.
What type of issues does CVE-2026-25139 cause?
CVE-2026-25139 can lead to multiple out-of-bounds read vulnerabilities when processing 6LoWPAN SFR fragments.
Which versions of RIOT are affected by CVE-2026-25139?
CVE-2026-25139 affects RIOT versions up to and including 2025.10.
Who is responsible for addressing CVE-2026-25139?
The maintainers of the RIOT project are responsible for addressing CVE-2026-25139 through upgrades and patches.