RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
CVE-2026-102692
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102692
RIOT
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "RIOT-OS",
"product": "RIOT",
"versions": [
{
"status": "affected",
"version": "< 2026.07"
}
]
}
]- Related CVEs
- CVE-2026-102692
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #34453 · Revision 1
- Added to Heist Feed
- Publisher date