{"id":"CVE-2026-107837","revision":"970dc4299ec44bbfa57ae27e55eb7f1e","records":[{"revision":"970dc4299ec44bbfa57ae27e55eb7f1e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107837","aliases":[],"title":"RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling","description":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.","state":0,"publishedAt":"2026-10-09T17:53:47.707+00:00","modifiedAt":"2026-10-13T20:26:34.327+00:00","affected":[{"ecosystem":"Vendor product","name":"RIOT","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"RIOT-OS\",\n                    \"product\": \"RIOT\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 2026.07\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","score":8.2,"severity":"HIGH"}],"references":["https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-m8mc-q4p7-p8j3","https://github.com/RIOT-OS/RIOT/pull/22504","https://github.com/RIOT-OS/RIOT/commit/0cae205cd1d110e0b8fce094714598322d56ce2d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107837","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107837","identifiers":["CVE-2026-107837"]},"retained":false,"historicalAffected":[]}],"coverage":[]}