CVE-2026-102692

Summary

RIOT OS's nanocoap component fails to validate CoAP Block2 option block numbers, allowing 32-bit integer overflow when calculating block offsets. This can lead to out-of-bounds memory access, denial of service, or memory corruption in IoT devices.

Exploitability

Exploitation is relatively straightforward for remote attackers who can send malformed CoAP packets to vulnerable RIOT devices, requiring no authentication or user interaction.

Blast radius

The vulnerability affects IoT devices running RIOT OS versions prior to 2026.07, potentially impacting a wide range of embedded systems including sensors, actuators, and networked appliances.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to RIOT OS version 2026.07 or later to receive the fix for the CoAP Block2 option validation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.