RIOT OS EUVD-2026-102947

Requires that the RIOT firmware be built with MODULE_DHCPV6_CLIENT_IA_PD (DHCPv6 prefix delegation) enabled and that the device operate as a DHCPv6 client; the attacker must control, compromise, or spoof a DHCPv6 server reachable on the same local link, then send a REPLY whose IA_PD (or IA_NA) option length is smaller than sizeof(dhcpv6_opt_ia_pd_t)/dhcpv6_opt_ia_na_t, defeating the absent minimum-length check in _parse_reply(). Limiting factors: DHCPv6 is link-local (adjacent network, not arbitrary Internet remote despite AV:N); the IA_PD code path is a compile-time option not present in all builds; and exploitation presumes a rogue or hijacked DHCPv6 server on-link rather than a wholly unauthenticated Internet attacker.

The input assigns CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but several signals temper the real-world urgency. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Two factors conflict with the Critical rating: (1) DHCPv6 is a link-local multicast protocol, so the attacker must sit on the same L2 segment as the client or compromise its DHCPv6 server - this is adjacent-network reality despite the vector claiming AV:N, verify network exposure before treating this as remotely Internet-reachable; and (2) the root weakness is CWE-125 out-of-bounds READ, which primarily yields a crash (DoS) and possible memory disclosure, so the C:H/I:H combination in the input looks overstated - integrity impact in particular is speculative ('may ... corrupt memory'). Exploitation is further gated on MODULE_DHCPV6_CLIENT_IA_PD (prefix delegation) being compiled in, which is not a universal default. Net: a genuine, patch-worthy memory-safety bug for IoT fleets running RIOT with DHCPv6-PD on untrusted links, but the 9.8 overstates likely blast radius for most deployments.

An attacker who controls or has compromised a DHCPv6 server on the local link (or who can race/spoof one) sends a crafted REPLY containing an IA_PD or IA_NA option whose declared length is smaller than the minimum structure. A RIOT device built with MODULE_DHCPV6_CLIENT_IA_PD parses the undersized option, underflows a size_t length, and performs unbounded out-of-bounds heap reads - crashing the device and potentially leaking adjacent heap memory. No public proof-of-concept is identified in the provided data.