CVE-2025-66646 RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass

What is CVE-2025-66646?

CVE-2025-66646 is a low-severity vulnerability in RIOT-OS RIOT, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving an fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL. However, the implementation still tries to copy the payload into the reassembly buffer, resulting in a NULL pointer dereference which crashes the OS (DoS). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be enabled and the attacker must be able to send arbitrary IPv6 packets to the victim. RIOT OS v2025.10 fixes the issue.

Weakness: CWE-476

Which versions are affected by CVE-2025-66646?

It affects 1 product.

Products include Riot-Os Riot.

How do I fix CVE-2025-66646?

No fix has been published for CVE-2025-66646 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-66646 being exploited?

There is no known exploitation of CVE-2025-66646 in the wild and no public exploit code.

Other vulnerabilities in RIOT-OS RIOT

• CVE-2024-32017 Buffer overflows in RIOT Critical 9.8
• CVE-2023-33975 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add Critical 9.8
• CVE-2023-24819 RIOT-OS vulnerable to Buffer Overflow during IPHC receive Critical 9.8
• CVE-2023-24823 RIOT-OS vulnerable to Packet Type Confusion during IPHC send Critical 9.8
• CVE-2021-27357 Memory corruption in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v8gx-q9m6-5xm9.