CVE-2026-107836 RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoapsockgetslice in sys/net/applicationlayer/nanocoap/sock.c accepts a Block2 response when blockcb sees the expecte...

CVE-2026-107836

The RIOT microcontroller operating system (version 2026.07 and earlier ) contains a vulnerability in the nanoCoAP client function nanocoap_sock_get_slice() located in sys/net/application_layer/nanocoap/sock.c. The root cause is a failure to verify that server-controlled szx and derived offsets ma...

CVE-2026-27703 RIOT has an Out-of-Bounds Write in nanoCoAP Handler

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things IoT devices and other embedded devices. In 2026.01 and earlier, the default handler for the wellknowncore resource coapwellknowncoredefaulthandler writes user-provided option data and...

CVE-2026-27703 RIOT has an Out-of-Bounds Write in nanoCoAP Handler

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things IoT devices and other embedded devices. In 2026.01 and earlier, the default handler for the wellknowncore resource coapwellknowncoredefaulthandler writes user-provided option data and...

CVE-2026-27703 RIOT has an Out-of-Bounds Write in nanoCoAP Handler

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things IoT devices and other embedded devices. In 2026.01 and earlier, the default handler for the wellknowncore resource coapwellknowncoredefaulthandler writes user-provided option data and...