Integer underflow in RIOT nanoCoAP Block2 slice handling
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
RIOT 2026.07 and earlier accept nanoCoAP Block2 responses without checking that the server's block size matches the requested block. A malicious CoAP server can send a larger block size, causing an integer underflow (CWE-191) and an out-of-bounds read before the payload buffer. The read can crash a client, causing denial of service, and may expose adjacent memory.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed release of RIOT is available as of this review.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-10 Threatist record created from CVE-2026-107836
References
More RIOT-OS vulnerabilities
- TI-2024-21112 Buffer overflows in RIOT CVSS 3.1CRITICAL 9.8
- TI-2023-16843 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add CVSS 3.1CRITICAL 9.8
- TI-2023-10319 RIOT-OS vulnerable to Buffer Overflow during IPHC receive CVSS 3.1CRITICAL 9.8
- TI-2026-22079 RIOT has an Out-of-Bounds Write in nanoCoAP Handler CVSS 3.1CRITICAL 9.8
- TI-2023-16842 RIOT-OS vulnerable to Race Condition in SFR Timeout CVSS 3.1HIGH 7.5
- TI-2023-16841 RIOT-OS vulnerable to NULL pointer dereference during NHC encoding CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences