RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.
Summary
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving an fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL. However, the implementation still tries to copy the payload into the reassembly buffer, resulting in a NULL pointer dereference which crashes the OS (DoS). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be enabled and the attacker must be able to send arbitrary IPv6 packets to the victim. RIOT OS v2025.10 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| RIOT-OS | RIOT | before 2025.10 | 2025.10 | Patch available | CNA |
- RIOT VendorRIOT-OS Affected before 2025.10 Fixed in 2025.10 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:riot-os:riot:*:*:*:*:*:*:*:* | before 2025.10 | Vulnerable | RIOT-OS |
| cpe:2.3:o:riot-os:riot:2025.10:rc1:*:*:*:*:*:* | 2025.10 rc1 | Vulnerable | RIOT-OS |
| cpe:2.3:o:riot-os:riot:2025.10:rc2:*:*:*:*:*:* | 2025.10 rc2 | Vulnerable | RIOT-OS |
| cpe:2.3:o:riot-os:riot:2025.10:rc3:*:*:*:*:*:* | 2025.10 rc3 | Vulnerable | RIOT-OS |
- cpe:2.3:o:riot-os:riot:*:*:*:*:*:*:*:* Versions before 2025.10 Vulnerable ·RIOT-OS
- cpe:2.3:o:riot-os:riot:2025.10:rc1:*:*:*:*:*:* Versions 2025.10 rc1 Vulnerable ·RIOT-OS
- cpe:2.3:o:riot-os:riot:2025.10:rc2:*:*:*:*:*:* Versions 2025.10 rc2 Vulnerable ·RIOT-OS
- cpe:2.3:o:riot-os:riot:2025.10:rc3:*:*:*:*:*:* Versions 2025.10 rc3 Vulnerable ·RIOT-OS
Remediation
- Fix · CNA RIOT (RIOT-OS) Fixed in 2025.10
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66646
References
Exploit 2
Other 8
- https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L411
- https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L420
- https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L490
- https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L532
- https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L534
- https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L544
- https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L150C1-L150C76
- https://github.com/RIOT-OS/RIOT/releases/tag/2025.10
More RIOT-OS Riot vulnerabilities
- TI-2024-21112 Buffer overflows in RIOT CVSS 3.1CRITICAL 9.8
- TI-2023-16843 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add CVSS 3.1CRITICAL 9.8
- TI-2023-10319 RIOT-OS vulnerable to Buffer Overflow during IPHC receive CVSS 3.1CRITICAL 9.8
- TI-2026-22079 RIOT has an Out-of-Bounds Write in nanoCoAP Handler CVSS 3.1CRITICAL 9.8
- TI-2023-16842 RIOT-OS vulnerable to Race Condition in SFR Timeout CVSS 3.1HIGH 7.5
- TI-2023-16841 RIOT-OS vulnerable to NULL pointer dereference during NHC encoding CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences