CVE-2026-5857: Out-of-bounds Write

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

CVE-2026-41144

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds check byteOffset + dataSize fileSize uses U32 addition that wraps around on overflow. An attacker-crafted DataPacket with...

Engel P-Adic Isogeny-Based Cryptography over Laurent Series: Foundations, Security, and an ESP32 Implementation

Securing the Internet of Things IoT against quantum attacks requires public-key cryptography that i remains compact and ii runs efficiently on microcontrollers, capabilities many post-quantum PQ schemes lack due to large keys and heavy arithmetic. We address both constraints simultaneously with, ...

FuzzBox: Blending Fuzzing into Emulation for Binary-Only Embedded Targets

Coverage-guided fuzzing has been widely applied to address zero-day vulnerabilities in general-purpose software and operating systems. This approach relies on instrumenting the target code at compile time. However, applying it to industrial systems remains challenging, due to proprietary and...