CVE-2026-107837
Received Received - Intake

Buffer Overflow in RIOT OS 6LoWPAN Fragment Handling

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-107837
EUVD
EUVD-2026-95932

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
RIOT-OS RIOT <= 2026.07

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read issue in the RIOT operating system's 6LoWPAN network layer. It occurs when processing malformed 6LoWPAN fragments. The _receive() function in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c fails to properly validate packet size before interpreting it as a fragment header. This allows an attacker to send a specially crafted fragment that causes the system to read memory outside the allocated buffer, potentially exposing sensitive data or crashing the network stack.

Detection Guidance

Detecting this vulnerability requires monitoring for malformed 6LoWPAN fragments. Use network sniffing tools like Wireshark to inspect 6LoWPAN traffic for undersized fragments. Check RIOT OS logs for crashes or memory access violations in the network stack. Enable AddressSanitizer (ASAN) during compilation to detect out-of-bounds reads.

Impact Analysis

This vulnerability can lead to memory disclosure where sensitive information might be exposed. It can also cause the network stack to crash, resulting in denial of service. Since it affects embedded IoT devices running RIOT OS, it could disrupt critical operations in systems relying on these devices for network connectivity.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive data, which violates GDPR's data protection requirements. For HIPAA, it might compromise protected health information if medical IoT devices are affected. The out-of-bounds read could lead to unauthorized data access, creating compliance violations for organizations handling regulated data.

Mitigation Strategies

Apply the patch from the master branch if available. Monitor for malformed fragments and block suspicious traffic at the network perimeter. Update intrusion detection systems to flag 6LoWPAN fragments with invalid headers. Consider disabling 6LoWPAN SFF handling if not critical.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107837. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart