RIOT OS CVE-2025-66647

Requires that the firmware be built with the gnrc_ipv6_ext_frag module included (IPv6 extension-header fragment reassembly) - this is a non-default, build-time condition that significantly limits the exposed population. The attacker must be able to send arbitrary IPv6 packets to the victim (no authentication, per PR:N) and must perform a two-step sequence: first send a shorter fragment with offset=0 to force creation of an undersized reassembly buffer, then send a larger offset=0 fragment whose copy is not size-checked, overflowing the buffer. Affected version is RIOT v2025.07 (and 2025.10 release candidates rc1/rc2/rc3); the stable 2025.10 release is fixed. The required priming step is the attack requirement reflected as AT:P in the official vector.

Signals here point mostly in the low-to-moderate direction, with one internal conflict worth flagging. The official CVSS 4.0 vector scores only 1.7 (Low), modeling the impact as availability-only (VA:L) with no confidentiality or integrity effect and an attack requirement present (AT:P) - yet the description explicitly claims the buffer overflow 'corrupts the state of other packet buffers' and could be leveraged for 'further memory corruption (potentially resulting in remote code execution).' This is a direct conflict: the assigned score treats the flaw as a minor availability issue while the narrative describes a classic heap/buffer-corruption primitive with RCE potential - the RCE outcome is speculative ('might be able to', 'potentially') and not demonstrated, so it should not be treated as confirmed. EPSS is low at 0.97% (61st percentile), indicating no strong real-world exploitation pressure, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. Public exploit material is referenced via the GitHub Security Advisory (GHSA-wh3v-q6vr-j79r). Exposure is further gated: the vulnerable gnrc_ipv6_ext_frag module must be compiled into the firmware (not universal), and the attack requires a priming step (sending a short offset=0 fragment first). Net: this is a credible unauthenticated remote memory-corruption bug in affected RIOT builds, but given low EPSS, no KEV, a niche embedded OS, and a required non-default module, it is a moderate patch priority for RIOT operators rather than a broad emergency - reconcile the Low official score against the RCE claim with the vendor advisory before deprioritizing.

An attacker with IPv6 reachability to a RIOT device running the gnrc_ipv6_ext_frag module first sends a short fragment with offset=0 to force allocation of an undersized reassembly buffer, then sends a larger offset=0 fragment whose contents are copied in without a size check, overflowing the buffer and corrupting adjacent packet buffers. Publicly available exploit material is referenced in the GitHub Security Advisory; exploitation is remote and unauthenticated but carries an attack requirement (AT:P) due to the required priming sequence.