CVE-2025-66646High· 7.5▾ TwilightRIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementatio…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving an fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL. However, the implementation still tries to copy the payload into the reassembly buffer, resulting in a NULL pointer dereference which crashes the OS (DoS). To trigger the vulnerability, the gnrc_ipv6_ext_frag module must be enabled and the attacker must be able to send arbitrary IPv6 packets to the victim. RIOT OS v2025.10 fixes the issue.
riot < 2025.10riot = 2025.10Upgrade past the affected range:
riot 2025.10Connected by shared product, vendor, weakness, or advisory.
CVE-2025-66647Critical· 9.8RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices
CVE-2026-49868Critical· 9.8RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read
CVE-2026-102692Critical· 9.1RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems
CVE-2026-102693Critical· 9.6RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems
CVE-2026-107838High· 7.5RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems
CVE-2026-107836High· 7.1RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems