What is the CVSS score of CVE-2026-25139?

CVE-2026-25139 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of IoT are affected by CVE-2026-25139?

A critical vulnerability (CVE-2026-25139) affecting RIOT microcontroller OS poses significant risk to any organization deploying IoT and embedded devices running this platform.

Is there a public PoC exploit available for CVE-2026-25139?

Yes, a public proof-of-concept exploit is available for CVE-2026-25139. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25139?

Within 24 hours: Inventory all RIOT-based devices across your infrastructure and isolate critical systems from production networks if feasible. Within 7 days: Implement network segmentation to restrict IoT device communication, enable enhanced monitoring for suspicious device behavior, and contact RIOT maintainers for patch timeline. Within 30 days: Develop a patching plan once vendor patches are released, establish a hardware replacement strategy if patching is not viable, and conduct a full security assessment of affected device deployments.

IoT CVE-2026-25139

CRITICAL

Out-of-bounds Read (CWE-125)

2026-02-04 security-advisories@github.com

IoT Denial Of Service Riot

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 20, 2026 - 17:08 vuln.today

Public exploit code

CVE Published

Feb 04, 2026 - 18:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to read adjacent memory locations, or crash a vulnerable device running the 6LoWPAN stack. The received packet is cast into a sixlowpan_sfr_rfrag_t struct and dereferenced without validating the packet is large enough to contain the struct object. At time of publication, no known patch exists.

AnalysisAI

RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure or crashes on IoT devices.

Technical ContextAI

RIOT, an open-source microcontroller OS, has a CWE-125 out-of-bounds read vulnerability that can expose sensitive memory contents or crash IoT devices.