---
id: "CVE-2026-49868"
kind: "vulnerability"
aliases: ["CVE-2026-49868"]
title: "RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["dhcpv6", "embedded", "iot", "riot", "runtime"]
not_affected_if: ["dhcpv6-client-disabled", "ia-pd-disabled", "version-2026.07-or-later"]
published_at: "2026-10-16T17:17:34+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49868", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded…

RIOT, an open-source operating system for embedded IoT devices, has a DHCPv6 client that does not check option lengths in REPLY messages before parsing them. A malicious or compromised DHCPv6 server can send a crafted reply that causes out-of-bounds heap reads, crashing the device and possibly exposing or corrupting memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the device is built with MODULE_DHCPV6_CLIENT_IA_PD enabled and which RIOT version it runs (unknown if the sources give a command).

## Fix

Upgrade RIOT to version 2026.07 or later.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49868

## From the sources

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_