RIOT-OS vulnerabilities

CVEs per yearBy the year they were published

1. 202312
2. 20245
3. 20253
4. 20268

Newest CVEs

• CVE-2026-49868

  RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

  RIOT-OS · RIOT

  Critical9.8
• CVE-2026-102693

  RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID

  RIOT-OS · RIOT

  Critical9.6
• CVE-2026-102692

  RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access

  RIOT-OS · RIOT

  Critical9.1
• CVE-2026-107838

  RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

  RIOT-OS · RIOT

  High7.5
• CVE-2026-107837

  RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling

  RIOT-OS · RIOT

  High8.2
• CVE-2026-107836

  RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size

  RIOT-OS · RIOT

  High7.1
• CVE-2026-27703

  RIOT has an Out-of-Bounds Write in nanoCoAP Handler

  RIOT-OS · RIOT

  High7.5
• CVE-2026-25139

  RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments

  RIOT-OS · RIOT

  High8.7
• CVE-2025-66647

  RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass

  RIOT-OS · RIOT

  Low1.7
• CVE-2025-66646

  RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass

  RIOT-OS · RIOT

  Low1.7