CVE-2026-49868Critical· 9.8▾ MidnightRIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation bef…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Last analysed / modified upstream
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.
RIOT < 2026.07Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107836High· 7.1RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems
CVE-2026-102692Critical· 9.1RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access
CVE-2026-107837High· 8.2RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems
CVE-2026-102693Critical· 9.6RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID
CVE-2026-107838High· 7.5RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems
CVE-2025-66647Critical· 9.8RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices