RIOT OS CVE-2026-107837

Target must run RIOT 2026.07 or earlier with the GNRC network stack and 6LoWPAN SFF fragment handling path active (sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c _receive() routing into gnrc_sixlowpan_frag_recv()), and must process inbound 6LoWPAN fragments. No authentication or user interaction is required (PR:N/UI:N), and the malformed undersized fragment triggers the flaw against default fragment-handling behavior. The principal limiting factor is delivery: because 6LoWPAN rides on IEEE 802.15.4 radio, the attacker must be within radio range of the node or able to inject/route fragments into its mesh - not reachable from an arbitrary remote host unless a border router forwards attacker-controlled fragments inward.

The reporter-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 8.2) describes a low-complexity, unauthenticated flaw whose dominant impact is availability (A:H - crashing the GNRC network stack) with secondary limited memory disclosure (C:L), consistent with the CWE-125 out-of-bounds read. One key signal conflicts with the data: the vector claims AV:N (network), but 6LoWPAN is an IEEE 802.15.4 link-layer adaptation, so in practice an attacker must inject frames onto the target's low-power wireless link or routed mesh - closer to AV:A (adjacent) - which lowers real-world reachability from arbitrary Internet hosts; verify exposure against the specific deployment's border router/gateway configuration. No EPSS score, CISA KEV entry, POC, or SSVC decision data was provided, so there is no evidence of active or probable exploitation - this is a disclosed-but-not-yet-weaponized defect. Risk is elevated by the absence of a fixed repository release (only an unmerged/merged fix PR exists) and the ease of triggering a stack crash, but tempered by RIOT's niche embedded footprint and the link-local nature of 6LoWPAN. Net: a credible denial-of-service (and minor info-leak) priority for organizations actually running RIOT 6LoWPAN nodes, not a broad-impact emergency.

An attacker within radio range of, or able to route 6LoWPAN frames to, a RIOT 2026.07-or-earlier IoT node sends a malformed, undersized 6LoWPAN fragment. The GNRC stack passes it into SFF fragment handling after only a minimal payload check and interprets it as a sixlowpan_frag_t header without confirming the snip holds the required bytes, causing gnrc_sixlowpan_frag_recv() to read beyond the packet buffer - leaking adjacent memory and crashing the network stack. No public exploit is identified, though the fix commit (0cae205) discloses the exact missing bounds check.