Riot
CVE-2026-25139
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed 6LoWPAN packet
-
ExploitSend via network to vulnerable device
-
ExecutionTrigger out-of-bounds read in sixlowpan_sfr_rfrag_t struct
-
ImpactRead adjacent memory or crash device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Device must run RIOT OS version 2025.10 or prior with 6LoWPAN stack enabled and reachable over network. No authentication required. Attacker must have network-level capability to send or manipulate IPv6 packets to the target device. |
| Impact | CVSS 9.1 with PoC. RIOT is used in constrained IoT devices — memory disclosure could expose cryptographic keys or sensor data. |
| Exploit ScenarioDerived | An attacker sends crafted network packets to a RIOT-based IoT device, triggering the OOB read to leak memory contents including encryption keys. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure or crashes on IoT devices.
Earlier versions of this analysis (1)
Out-of-bounds read in RIOT OS enables IoT device information disclosure.
RemediationAI
Update RIOT OS. Apply the security patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RIOT, an open-source microcontroller OS, has a CWE-125 out-of-bounds read vulnerability that can expose sensitive memory contents or crash IoT devices.
Know when Riot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to read adjacent memory locations, or crash a vulnerable device running the 6LoWPAN stack. The received packet is cast into a sixlowpan_sfr_rfrag_t struct and dereferenced without validating the packet is large enough to contain the struct object. At time of publication, no known patch exists.
Executive ViewAI
A critical vulnerability (CVE-2026-25139) affecting RIOT microcontroller OS poses significant risk to any organization deploying IoT and embedded devices running this platform. With a CVSS score of 9.1, public exploits available, and no patch currently available, immediate action is required to assess exposure and implement interim protections before attackers actively exploit this vulnerability at scale.
Implement strict network segmentation and firewall rules limiting IoT device communication to essential ports/protocols only; disable unnecessary services/features on RIOT devices where possible; deploy intrusion detection/prevention systems (IDS/IPS) tuned to detect exploitation attempts; require multi-factor authentication for any administrative access to device management systems; increase logging and monitoring of RIOT device traffic for anomalous behavior; consider air-gapping or removing critical RIOT devices from network until patch is available; maintain offline backups of device configurations for rapid recovery if compromise occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process
RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in s
RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit a
RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit a
RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit a
RIOT is an operating system for internet of things (IoT) devices. Rated high severity (CVSS 7.5), this vulnerability is
RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to proc
RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attac
In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all input
RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all me
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT)
Stack-based buffer overflow in the ipv6_addr_from_str function in sys/net/network_layer/ipv6/addr/ipv6_addr_from_str.c i
Exploit-DB