RIOT OS: Out-of-bounds read in 6LoWPAN fragment handling
Summary
RIOT is an open-source operating system for microcontrollers used in IoT and embedded devices. A flaw in the 6LoWPAN receive path can process an undersized packet as a fragment header without checking its length, allowing a remote attacker to send a malformed fragment. This can lead to reading beyond the packet buffer, potentially disclosing memory and crashing the network stack.
Affected
- RIOT up to and including 2026.07
- Mainly affects devices with 6LoWPAN/GNRC networking enabled
Fixed in
- Fix available in master via commit 0cae205 (PR #22504)
- Fixed release version: Unknown.
Workaround
- Unknown. No vendor-published workaround.
- Reduce exposure by restricting radio and gateway access to affected devices.
Exploitation
- No known exploitation in the wild.
- VulDB reports no exploit available.
- CISA SSVC: exploitation none, automatable yes.
Our recommendation
- Inventory IoT and embedded devices and check whether they use RIOT.
- Ask device suppliers when a firmware build with the fix will be available.
- Segment radio-connected devices and gateways from critical networks.
- Build firmware from a fixed master commit if you have a build pipeline, and monitor the GitHub advisory for a release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-m8mc-q4p7-p8j3 github.com
- RIOT commit 0cae205 (fix) github.com
- RIOT pull request #22504 github.com
- OSV entry CVE-2026-107837 osv.dev
- VulDB entry 415989 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:44.
Original description (NVD)
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.