RIOT OS
CVE-2025-66646
LOW
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach victim over IPv6 network
-
ExploitSend fragment offset 0 with empty payload
-
ExecutionNULL payload pointer dereferenced in reassembly
-
ImpactOS crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the optional 'gnrc_ipv6_ext_frag' module (GNRC IPv6 extension-header fragmentation/reassembly) be compiled in and enabled on the target - devices without this module are not affected, which is the primary limiting factor. The attacker must also be able to send arbitrary IPv6 packets to the victim (IPv6 network reachability/adjacency). The specific trigger is a crafted IPv6 fragment with fragment offset 0 and an empty payload, which leaves the payload pointer NULL while the reassembly copy still executes. No authentication or user interaction is required (PR:N/UI:N), but the dependency on the non-universal fragmentation module meaningfully narrows the exposed population. |
| Impact | All signals converge on this being a LOW real-world priority. The vendor CVSS 4.0 score is 1.7 (Low), reflecting availability-only impact (VA:L, with VC:N/VI:N) and an attack requirement present (AT:P). This is a CWE-476 NULL pointer dereference that produces only a denial of service - there is no confidentiality or integrity impact and no path to code execution. EPSS is 0.68% (51st percentile), which is unremarkable and consistent with a low-severity DoS. Public exploit code exists (GitHub Security Advisory GHSA-v8gx-q9m6-5xm9 plus a reproducer archive), which raises ease-of-reproduction, but POC availability is NOT active exploitation: the CVE is NOT listed in CISA KEV, so there is no evidence of in-the-wild use. One signal to flag explicitly: the vendor rated availability as VA:L, yet the description states the flaw 'crashes the OS,' which for a single-purpose embedded device is arguably a complete availability loss (A:H) - my independent assessment rates it higher than the vendor on availability (see assessed vectors). Net: a cleanly patched, exploit-public but low-impact DoS gated behind an optional module; routine patch to 2025.10 rather than emergency response. |
| Exploit ScenarioDerived | An attacker with IPv6 reachability to a RIOT OS device that has the gnrc_ipv6_ext_frag module enabled sends a single crafted IPv6 fragment with fragment offset 0 and an empty payload. The reassembly code sets the payload pointer to NULL but still attempts to copy the payload, dereferencing NULL and crashing the device (DoS). Public exploit/reproducer code is available via the GitHub Security Advisory, making reproduction trivial, though impact is limited to a crash with no code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in RIOT OS 2025.07 allows an unauthenticated, remote IPv6 sender to crash the operating system by transmitting a fragmented IPv6 packet whose first fragment has offset 0 and an empty payload. The malformed fragment leaves the payload pointer NULL while the reassembly code still attempts to copy that NULL payload into the reassembly buffer, producing a NULL pointer dereference (CWE-476) that faults the kernel and reboots/halts the device. Publicly available exploit code exists (a vendor-published reproducer archive accompanies the GitHub security advisory), though there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.68% (51st percentile); exploitation additionally requires that the optional gnrc_ipv6_ext_frag module be compiled in, which substantially narrows the exposed population. RIOT OS 2025.10 is the vendor-released fix.
RemediationAI
Upgrade to RIOT OS 2025.10, which contains the fix (vendor-released patch: 2025.10); see the advisory at https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-v8gx-q9m6-5xm9 and the release at https://github.com/RIOT-OS/RIOT/releases/tag/2025.10. If upgrading is not immediately possible, the most direct compensating control is to drop the gnrc_ipv6_ext_frag module from the build (remove it from USEMODULE/application Makefile), which removes the vulnerable code path entirely - the trade-off is that the device can no longer reassemble fragmented IPv6 datagrams, breaking any traffic that relies on IPv6 fragmentation (e.g. large UDP/DNS responses or tunnels over links with small MTUs). As a network-level alternative, filter IPv6 Fragment extension headers at the border or only permit IPv6 traffic from trusted/adjacent peers, accepting that this may block legitimate fragmented traffic and is easily bypassed by an already-adjacent attacker. Because exploitation only requires IPv6 reachability (no authentication or user interaction, PR:N/UI:N), keep IPv6-exposed RIOT nodes off untrusted segments until patched; as a longer-term hardening measure, ensure the platform has a watchdog so the fault-induced crash results in automatic recovery rather than a permanently dead node.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in RIOT's GNRC (Generic Network Stack) IPv6 extension-header fragmentation/reassembly path, specifically sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c (referenced lines 411, 420, 490, 532, 534, 544) and the packet buffer implementation in gnrc/pktbuf_static/gnrc_pktbuf_static.c. IPv6 fragmentation (RFC 8200) splits datagrams into fragments carried in a Fragment extension header; the receiver buffers them by offset and reassembles. When a fragment arrives with fragment offset 0 but zero-length payload, the code sets the payload pointer to NULL and then proceeds to copy that payload into the reassembly buffer without a NULL guard - a classic CWE-476 NULL pointer dereference. On a bare-metal microcontroller OS with no memory-protection boundary this faults the whole system rather than just the network task, producing a full device DoS. The vulnerable code is only compiled when the optional gnrc_ipv6_ext_frag module is enabled, so products built without IPv6 reassembly are unaffected; the CPE data (cpe:2.3:o:riot-os:riot:* plus 2025.10 rc1/rc2/rc3) reflects the upstream project rather than a single hardware target, since RIOT is a portable RTOS.
Know when Riot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Remote unauthenticated crafted IPv6 fragment triggers deterministically (AV:N/AC:L/PR:N/UI:N); a full OS crash is complete availability loss (A:H) with no confidentiality or integrity impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving an fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL. However, the implementation still tries to copy the payload into the reassembly buffer, resulting in a NULL pointer dereference which crashes the OS (DoS). To trigger the vulnerability, the gnrc_ipv6_ext_frag module must be enabled and the attacker must be able to send arbitrary IPv6 packets to the victim. RIOT OS v2025.10 fixes the issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process
RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in s
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o
RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit a
RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit a
RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit a
RIOT is an operating system for internet of things (IoT) devices. Rated high severity (CVSS 7.5), this vulnerability is
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to proc
RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attac
In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all input
RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all me
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT)
Exploit-DB