RIOT OS EUVD-2026-102945

Requires the target to run a RIOT nanocoap or gcoap CoAP server that processes Block2 blockwise transfer options (e.g., nanocoap_server, the nanocoap fileserver _get_file/_get_directory handlers, gcoap DNS, or the gcoap_block_server example) and to be built for a 32-bit target, where blknum*blksize multiplication overflows; versions prior to 2026.07 at/around master baseline commit aeeae69e are affected. Exploitation is remote and unauthenticated (CVSS PR:N) with no user interaction, triggered by a single crafted Block2 option whose block number exceeds the RFC 7959 20-bit maximum. Limiting factors: the CoAP/Block2 server endpoint must be network-reachable to the attacker, the device must be a 32-bit build, and reliable memory corruption (versus a simple crash) depends on the target's memory layout; the fix also now rejects Block2 option lengths greater than 3 bytes per RFC 7959.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, base 9.1) describes a remotely reachable, unauthenticated, low-complexity flaw with high integrity and availability impact and no confidentiality impact - consistent with an integer overflow (CWE-190) that yields out-of-bounds memory access, memory corruption, and denial of service rather than data disclosure. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability signals are absent and cannot be weighed against the high CVSS. The elevated score is driven almost entirely by the theoretical network-reachable memory-corruption primitive; in practice the real-world risk is tempered by the affected product being a niche embedded/IoT operating system (RIOT) and by the overflow being specific to 32-bit targets with nanocoap Block2/blockwise CoAP handling enabled. One nuance to flag explicitly: the description states the bug 'allows block offset multiplication to overflow on 32-bit targets,' so the full severity is architecture-conditional - 64-bit builds are not described as affected - which the single network-vector CVSS does not capture. Net assessment: a genuinely serious, patch-worthy memory-safety bug for anyone exposing RIOT nanocoap/gcoap CoAP servers to untrusted networks, but there is no evidence of active exploitation, no public exploit, and no EPSS signal, so it should be prioritized as a credible-but-not-confirmed-exploited remote flaw rather than an urgent in-the-wild emergency.

A RIOT-based IoT device runs a nanocoap or gcoap server that answers Block2 (blockwise) GET requests (e.g., the nanocoap_server, fileserver, or gcoap DNS/block examples). A remote attacker on the same reachable network sends a single malformed CoAP request carrying an oversized Block2 option whose block number exceeds the 20-bit maximum, causing block-offset multiplication to overflow during coap_block_slicer_init() and producing an invalid slice range that triggers out-of-bounds memory access, device crash (DoS), or memory corruption. No authentication or user interaction is required; no public exploit code was identified at time of analysis.