GHSA-gwgv-6976-hxrg: RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID

Q: Which deployments are exposed to this issue?

RIOT deployments using the ATWINC15x0 driver are affected before version 2026.04 when MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled.

Q: What does an attacker need to exploit the vulnerability?

An attacker only needs to be nearby enough to advertise a malformed or oversized Wi-Fi SSID. No privileges or user interaction are required.

Q: Is a device affected merely by connecting to a malicious network?

The malformed SSID is processed during Wi-Fi scanning, so exploitation can occur when the device scans nearby advertised networks. The description does not require the device to connect to the attacker’s network.

Q: What is the remediation?

Update RIOT to version 2026.04, which fixes the issue.

Published Oct 16, 2026

Updated

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's atwinc15x0stasetcurrentssid function uses strcpy to copy an SSID without checking the destination size. When MODULEATWINC15X0DYNAMICCONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.

Affected Software

1 affected component

RIOT RIOT<2026.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade RIOT to a version that resolves this vulnerability.
Fixed in 2026.04

Event History

Oct 16, 2026

CVE Published

via OSV·04:49 PM

Data Sourced

via OSV·04:49 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

RIOT deployments using the ATWINC15x0 driver are affected before version 2026.04 when MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled.

What does an attacker need to exploit the vulnerability?

An attacker only needs to be nearby enough to advertise a malformed or oversized Wi-Fi SSID. No privileges or user interaction are required.

Is a device affected merely by connecting to a malicious network?

The malformed SSID is processed during Wi-Fi scanning, so exploitation can occur when the device scans nearby advertised networks. The description does not require the device to connect to the attacker’s network.

What is the remediation?

Update RIOT to version 2026.04, which fixes the issue.

GHSA-gwgv-6976-hxrg: RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is a device affected merely by connecting to a malicious network?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is a device affected merely by connecting to a malicious network?

What is the remediation?