CVE-2026-49868

9.8 CRITICALpublic exploit available

Published 2026-10-16 · Updated 2026-10-16

AI risk analysis

Summary: A buffer over-read vulnerability in RIOT OS DHCPv6 client allows remote attackers to crash devices and potentially expose/corrupt memory by sending malformed DHCPv6 REPLY messages with truncated option lengths. This affects IoT devices running vulnerable versions of the OS.
Exploitability: Exploitation is relatively straightforward as it requires only a malicious DHCPv6 server to send specially crafted REPLY messages with truncated IA_PD options, no authentication required.
Blast radius: The vulnerability could impact large numbers of IoT devices that rely on DHCPv6 for network configuration, potentially causing widespread service disruption and memory corruption across embedded systems.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to RIOT OS version 2026.07 or later to address the buffer over-read vulnerability in DHCPv6 client implementation.

iotnetworkmemory-corruption

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-125, CWE-191

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.