{"id":"CVE-2026-102692","kind":"vulnerability","aliases":["CVE-2026-102692"],"related":[],"title":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded…","description":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption. This vulnerability is fixed in 2026.07.","summary":"RIOT, an open-source operating system for IoT microcontrollers, has an integer overflow in its nanocoap CoAP server when handling oversized Block2 option values on 32-bit targets. A remote CoAP client can send a malformed Block2 option to cause out-of-bounds memory access, denial of service, or memory corruption.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["32-bit","coap","embedded","iot","nanocoap","riot","runtime"],"not_affected_if":["64-bit-target","default-config","no-coap-server"],"how_to_check":"Check whether the firmware is built from RIOT master at or after commit aeeae69e and before the fix, or runs a RIOT release before 2026.07.\nCheck whether the device runs nanocoap on a 32-bit target with a CoAP server listening on the network.","fix":"Move to RIOT 2026.07 or later, or to a master build that includes the verified fix; the fix is not in a released version before 2026.07.","status":"open","published_at":"2026-10-16T17:17:16+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:13:38+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T22:13:38Z","model":"claude-haiku-5-5","output":{"fix":"Move to RIOT 2026.07 or later, or to a master build that includes the verified fix; the fix is not in a released version before 2026.07.\nunknown","reach":"network","impact":"high","summary":"RIOT, an open-source operating system for IoT microcontrollers, has an integer overflow in its nanocoap CoAP server when handling oversized Block2 option values on 32-bit targets. A remote CoAP client can send a malformed Block2 option to cause out-of-bounds memory access, denial of service, or memory corruption.","category":"runtime","who_cares":["riot","nanocoap","coap","iot","embedded","32-bit"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker may cause memory corruption or device crash via crafted CoAP packet.","analyst_note":"Confirm whether the nanocoap block-slicer code path can yield code execution on 32-bit targets and find the fix commit or advisory for RIOT 2026.07 at the NVD link.","how_to_check":"Check whether the firmware is built from RIOT master at or after commit aeeae69e and before the fix, or runs a RIOT release before 2026.07.\nCheck whether the device runs nanocoap on a 32-bit target with a CoAP server listening on the network.\nunknown","needs_analyst":true,"not_affected_if":["no-coap-server","64-bit-target","default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00055,"input_tokens":2908,"output_tokens":519,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-102692':21A,24A '-2026':20A,23A '20':118C '2026.07':107C,199C '32':25B,59B,130C 'accept':109C 'access':79B,187C 'aeeae69e':139C 'affect':134C 'allow':123C 'baselin':136C 'bit':26B,60B,119C,131C 'block':121C,124C,160C 'block2':55B,70B,112C,171C 'blockopt':157C 'bound':77B,185C 'caus':73B,181C 'client':65B,166C 'coap':27B,50B,64B,111C,155C,159C,165C 'commit':138C 'corrupt':85B,193C 'cve':19A,22A 'denial':80B,188C 'design':10A,95C 'devic':15A,100C 'embed':18A,28B,103C 'enforc':116C 'fix':142C,197C 'get':156C 'handl':53B 'init':162C 'integ':45B 'internet':12A,97C 'invalid':176C 'iot':29B,41B 'later':144C 'malform':69B,170C 'master':135C,146C 'maximum':120C 'memori':78B,84B,186C,192C 'microcontrol':7A,42B,92C 'multipl':126C 'nanocoap':30B,49B,108C 'number':122C 'offset':125C 'open':5A,36B,90C 'open-sourc':4A,35B,89C 'oper':8A,38B,93C 'option':56B,71B,113C,172C 'out-of-bound':74B,182C 'overflow':46B,128C 'overs':54B,110C,151C 'pass':153C 'prior':105C 'produc':174C 'rang':178C 'remain':148C 'remot':63B,164C 'riot':1A,31B,33B,86C 'runtim':32B 'send':67B,168C 'server':51B 'servic':82B,190C 'slice':177C 'slicer':161C 'sourc':6A,37B,91C 'system':9A,39B,94C,104C 'target':61B,132C 'thing':14A,99C 'unreleas':149C 'valu':57B,114C,152C 'verifi':141C 'vulner':195C 'without':115C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T17:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102692","severity":null,"published_at":"2026-10-16T17:17:16+00:00","modified_at":"2026-10-16T22:17:08+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}