CVE-2026-49868 Integer overflow in RIOT
A malicious DHCPv6 server can trigger a size_t underflow in RIOT OS, causing out-of-bounds heap reads that may crash the device or leak memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49868?
CVE-2026-49868 is a critical vulnerability in RIOT-OS RIOT, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.
Which versions are affected by CVE-2026-49868?
How do I fix CVE-2026-49868?
No fix has been published for CVE-2026-49868 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-49868 being exploited?
There is no known exploitation of CVE-2026-49868 in the wild and no public exploit code.
Sources
Also known as GHSA-p3fx-9qcg-jmcf.