RIOT: Out-of-bounds read in DHCPv6 client via missing option length check
Summary
RIOT, an open-source operating system for IoT and embedded devices, has a missing minimum-length check in the DHCPv6 client when parsing IA_PD and IA_NA options. A malicious or compromised DHCPv6 server can send a crafted REPLY that causes out-of-bounds heap reads, which can crash the device and may expose or corrupt memory. The issue only affects builds with MODULE_DHCPV6_CLIENT_IA_PD enabled, and an attacker needs to be able to send DHCPv6 replies to the device.
Affected
- RIOT versions before 2026.07
- Only builds with the DHCPv6 client and MODULE_DHCPV6_CLIENT_IA_PD enabled are affected per the description
Fixed in
- Fixed in RIOT 2026.07 (commit c9830dc5f2a9bf97418de4fc7d7167d00a45df17)
- No backports to older branches identified
Workaround
- Unknown. No vendor workaround published.
- Disabling MODULE_DHCPV6_CLIENT_IA_PD if prefix delegation is not required (not a vendor recommendation)
Exploitation
- No evidence of exploitation in the wild found
- No public proof of concept reported
- CISA SSVC: Exploitation none, Automatable no, Technical impact total
- EPSS score 0.00371 (low)
Our recommendation
- Identify RIOT-based devices and firmware in use, especially sensors, building automation and gateways
- Update affected devices to RIOT 2026.07 or later
- If an update is not possible, disable the IA_PD module and restrict which DHCPv6 servers and network segments the device can reach
- Monitor affected devices for unexpected crashes or reboots
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-p3fx-9qcg-jmcf github.com
- Fix commit c9830dc github.com
- Pull request #22322 github.com
- RIOT release 2026.07 github.com
- NVD/CVE record via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:38.
Original description (NVD)
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.