CVE-2026-102692
Received Received - Intake

Memory Corruption in RIOT OS CoAP Block2 Handling

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-102692
EUVD
EUVD-2026-102945

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
RIOT-OS RIOT < 2026.07

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow issue in the RIOT operating system's nanocoap library. It occurs when processing CoAP Block2 options, where oversized values bypass the 20-bit block number limit. This causes an overflow during offset calculations, leading to invalid memory access ranges. The flaw exists in functions like coap_block_slicer_init() and coap_get_blockopt(), allowing remote attackers to send malformed packets that trigger out-of-bounds memory access, denial of service, or memory corruption.

Detection Guidance

To detect this vulnerability, monitor CoAP traffic for malformed Block2 options. Use Wireshark or tcpdump to capture and inspect CoAP packets for oversized Block2 values exceeding 3 bytes. Check RIOT OS versions prior to 2026.07 for vulnerable commits like aeeae69e.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to crash your system via denial of service, corrupt memory leading to unpredictable behavior, or potentially execute arbitrary code depending on system configuration. Systems using RIOT OS versions prior to 2026.07 are vulnerable, especially those running on 32-bit targets where overflow risks are higher.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing sensitive data or disrupting critical services. A denial of service or memory corruption could lead to unauthorized access or loss of data integrity, violating GDPR's data protection principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade RIOT OS to version 2026.07 or later. If upgrading is not possible, apply patches from commits like 6b283ace or ee1fa0ef. Block or filter malformed CoAP Block2 options at the network perimeter. Monitor systems for crashes or memory corruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102692. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart