RIOT OS RIOT

• CVE-2026-49868 Critical 9.8 RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read 0.4%
• CVE-2026-102693 Critical 9.6 RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID 0.2%
• CVE-2026-102692 Critical 9.1 RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access 0.4%
• CVE-2026-107838 High 7.5 RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion 0.3%
• CVE-2026-107837 High 8.2 RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling 0.4%
• CVE-2026-107836 High 7.1 RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size 0.3%
• CVE-2026-27703 High 7.5 RIOT has an Out-of-Bounds Write in nanoCoAP Handler 0.5%
• CVE-2026-25139 High 8.7 RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments 0.6%
• CVE-2025-66647 Low 1.7 RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass 1.0%
• CVE-2025-66646 Low 1.7 RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass 0.7%
• CVE-2025-53888 Medium 6.6 RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c 0.9%
• CVE-2024-53980 Medium 6.9 Spoofed length byte traps CC2538 in endless loop 0.8%
• CVE-2024-52802 High 7.5 RIOT-OS missing dhcpv6_opt_t minimum header length check 0.8%
• CVE-2024-32018 High 8.8 Ineffective size check due to assert() and buffer overflow in RIOT 1.5%
• CVE-2024-32017 Critical 9.8 Buffer overflows in RIOT 1.6%
• CVE-2024-31225 High 8.4 Lack of size check and buffer overflow in RIOT 1.3%
• CVE-2023-33975 Critical 9.8 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add 1.5%
• CVE-2023-33974 High 7.5 RIOT-OS vulnerable to Race Condition in SFR Timeout 0.7%
• CVE-2023-33973 High 7.5 RIOT-OS vulnerable to NULL pointer dereference during NHC encoding 1.0%
• CVE-2023-24826 Medium 5.9 Usage of Uninitialized Timer during forwarding of Fragments with SFR 0.8%
• CVE-2023-24825 High 7.5 RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark 1.0%
• CVE-2023-24817 High 7.5 RIOT-OS vulnerable to Out of Bounds write in routing with SRH 0.6%
• CVE-2023-24823 Critical 9.8 RIOT-OS vulnerable to Packet Type Confusion during IPHC send 1.0%
• CVE-2023-24822 High 7.5 RIOT-OS vulnerable to Null Pointer dereference during IPHC encoding 0.9%
• CVE-2023-24821 High 7.5 RIOT-OS vulnerable to Integer Underflow during defragmentation 0.9%
• CVE-2023-24820 High 7.5 RIOT-OS vulnerable to Integer Underflow during IPHC receive 0.9%
• CVE-2023-24819 Critical 9.8 RIOT-OS vulnerable to Buffer Overflow during IPHC receive 1.0%
• CVE-2023-24818 High 7.5 RIOT-OS vulnerable to null pointer dereference during fragment forwarding 1.2%