RIOT nanocoap: Integer overflow in CoAP Block2 handling
Summary
The nanocoap CoAP library in the RIOT microcontroller operating system does not enforce the 20-bit maximum for the Block2 block number. On 32-bit targets, an oversized value can overflow the block offset calculation and produce an invalid slice range. A remote, unauthenticated CoAP client can exploit this to cause out-of-bounds memory access, denial of service or memory corruption on affected IoT devices.
Affected
- RIOT versions before 2026.07 (CNA data: affected < 2026.07)
- Affected master baseline according to the vulnerability description: commit aeeae69e
- Relevant mainly on 32-bit microcontroller targets with a reachable CoAP service
Fixed in
- Fixed in RIOT 2026.07 according to the CVE data and third-party database entries.
- Conflict: the vulnerability description states that the verified fix is on master and unreleased. The fix commits 6b283ace and ee1fa0ef could not be fully verified. Confirm the fixed version with the RIOT project or the device vendor before treating 2026.07 as the remediation target.
Workaround
- No vendor-published workaround found. Unknown.
- Restrict access to the device's CoAP service (UDP, typically port 5683) to trusted hosts and block it at the network edge.
Exploitation
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- EPSS 0.0035 (low).
- Exploitation in the wild: Unknown. No public proof of concept found; the search was not exhaustive.
Our recommendation
- Inventory IoT devices and check whether any use RIOT and a reachable CoAP service.
- Ask device vendors whether they use RIOT and which version, and request a patch or fixed firmware.
- Block external access to CoAP (UDP 5683) at the firewall until a fixed version is installed.
- Confirm the fix commits before accepting RIOT 2026.07 as the target version.
- Monitor for unusual CoAP traffic and device crashes or resets.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- RIOT security advisory GHSA-8365-gj33-rgpf github.com
- RIOT commit 6b283ace github.com
- RIOT commit ee1fa0ef github.com
- RIOT release 2026.07 github.com
- CVE-2026-102692 on vulners.com vulners.com
- VulDB entry 421352 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:25.
Original description (NVD)
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.