CVE-2026-102692 RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access
Remote attackers can trigger integer overflows in RIOT OS CoAP handling, causing out-of-bounds memory access, denial of service, or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102692?
CVE-2026-102692 is a critical vulnerability in RIOT-OS RIOT, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
Which versions are affected by CVE-2026-102692?
How do I fix CVE-2026-102692?
No fix has been published for CVE-2026-102692 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-102692 being exploited?
There is no known exploitation of CVE-2026-102692 in the wild and no public exploit code.
Sources
Also known as GHSA-8365-gj33-rgpf.