Live › vulnerability › CVE-2026-102692
Go to dashboardRIOT, an open-source operating system for IoT microcontrollers, has an integer overflow in its nanocoap CoAP server when handling oversized Block2 option values on 32-bit targets. A remote CoAP client can send a malformed Block2 option to cause out-of-bounds memory access, denial of service, or memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Move to RIOT 2026.07 or later, or to a master build that includes the verified fix; the fix is not in a released version before 2026.07.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.
This page as .md · .json · in your agent: get_signal("CVE-2026-102692")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.