Vulnerability · Published Oct 9, 2026 · Assigned by GitHub_M

CVE-2026-107836RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size

High 7.1

In plain English

A high-severity out-of-bounds read in RIOT from RIOT-OS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.3%top 77.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.

Affected products (as reported)

Vendor	Product	Versions
RIOT-OS	RIOT	<= 2026.07

Weakness: CWE-125, CWE-191 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-x924-p5fq-26pc x_refsource_CONFIRM
https://github.com/RIOT-OS/RIOT/pull/22518 x_refsource_MISC
https://github.com/RIOT-OS/RIOT/commit/49b894cbe091510093273b98d92c4a17167d6839 x_refsource_MISC