CVE-2026-49868: RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply() in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULEDHCPV6CLIENTIAPD is enabled, causing parseiapdoption to read past the option body, sizet underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RIOTto a version that resolves this vulnerability.Fixed in 2026.07
Event History
Frequently Asked Questions
Which deployments are affected?
RIOT deployments using the DHCPv6 client with MODULE_DHCPV6_CLIENT_IA_PD enabled are affected before version 2026.07.
What does an attacker need to exploit this issue?
An attacker needs to operate or compromise a DHCPv6 server able to send a crafted DHCPv6 REPLY to the target. No authentication, privileges, or user interaction are required.
What is the impact of a successful exploit?
A malformed IA_PD or IA_NA option can trigger a size_t underflow and unbounded out-of-bounds heap read. This can crash the device and may expose or corrupt memory.
What should teams do if they cannot patch immediately?
Restrict DHCPv6 service to trusted servers and prevent untrusted or compromised DHCPv6 servers from sending replies to affected devices. The provided data identifies version 2026.07 as the fix.