CVE-2026-49868
Received Received - Intake

Heap Out-of-Bounds Read in RIOT OS DHCPv6 Client

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-49868
EUVD
EUVD-2026-102947

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
RIOT-OS RIOT < 2026.07

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in RIOT-OS is a memory corruption issue in the DHCPv6 client. The _parse_reply() function fails to validate the minimum length of IA_PD and IA_NA option bodies before parsing them. A malicious DHCPv6 server can send a malformed REPLY message with an insufficient option length, causing a size_t underflow and unbounded out-of-bounds heap reads. This leads to device crashes and potential memory exposure or corruption.

Detection Guidance

Detecting this vulnerability requires monitoring DHCPv6 traffic for malformed REPLY messages with IA_PD or IA_NA options of insufficient length. Use Wireshark or tcpdump to capture DHCPv6 traffic and filter for malformed options. Check if MODULE_DHCPV6_CLIENT_IA_PD is enabled on RIOT devices. Look for crashes or memory corruption after DHCPv6 exchanges.

Impact Analysis

The impact includes remote device crashes, especially on bare-metal Cortex-M targets without MMU protection. It may expose sensitive heap contents like packet buffers or cryptographic material and corrupt RTOS data structures. Exploitation requires no authentication and can occur during standard DHCPv6 exchanges.

Mitigation Strategies

Upgrade RIOT-OS to version 2026.07 or later. Disable MODULE_DHCPV6_CLIENT_IA_PD if not required. Monitor network traffic for malformed DHCPv6 messages. Apply network-level protections to filter invalid DHCPv6 options.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49868. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart