{"id":"CVE-2026-107837","summary":"RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling","details":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.","aliases":["GHSA-m8mc-q4p7-p8j3"],"modified":"2026-10-11T07:04:25.643883090Z","published":"2026-10-09T17:53:47.707Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107837.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107837.json"},{"type":"ADVISORY","url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-m8mc-q4p7-p8j3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107837"},{"type":"FIX","url":"https://github.com/RIOT-OS/RIOT/commit/0cae205cd1d110e0b8fce094714598322d56ce2d"},{"type":"FIX","url":"https://github.com/RIOT-OS/RIOT/pull/22504"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/riot-os/riot","events":[{"introduced":"0"},{"fixed":"0cae205cd1d110e0b8fce094714598322d56ce2d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"2026.07"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2026.10-devel","2026.07-RC1","2026.07-devel","2026.04-RC1","2026.04-devel","2026.01-RC1","2026.01-devel","2025.10-RC1","2025.10-devel","2025.07-RC1","2025.07-devel","2025.04-RC1","2025.04-devel","2025.01-RC1","2025.01-devel","2024.10-RC1","2024.10-devel","2024.07-RC1","2024.04","2024.07-devel","2024.04-RC1","2024.04-devel","2024.01-RC1","2024.01-devel","2023.10-RC1","2023.10-devel","2023.07-RC1","2023.07-devel","2023.04-RC1","2023.04-devel","2023.01-RC1","2023.01-devel","2022.10-RC1","2022.10-devel","2022.07-RC1","2022.07-devel","2022.04-RC1","2022.04-devel","2022.01-RC1","2022.01-devel","2021.10-RC1","2021.10-devel","2021.07-RC1","2021.07-devel","2021.04-RC1","2021.04-devel","2021.01-RC1","2021.01-devel","2020.10-RC1","2020.10-devel","2020.07-RC1","2020.07-devel","2020.04-RC1","2020.04-devel","2020.01-RC1","2020.01-devel","2019.10-RC1","2019.10-devel","2019.07-RC1","2019.07-devel","2019.04-RC1","2019.04-devel","2019.01-RC1","2018.10-devel","2018.07-RC1","2019.01-devel","2018.10-RC1","2018.07-devel","2018.04-RC1","2018.04-devel","2018.01-RC1","2018.01-devel","2017.10-RC1","2017.10-devel","2017.07-RC1","2017.07-devel","2017.04-RC1","2017.04-devel","2017.01-RC1","2017.01-devel","2016.10-RC1","2016.10-devel","2016.07-RC2","2016.07-RC1","2016.04-RC1","2016.07-devel","2016.03-devel","2015.12-RC1","2015.12-devel","2015.09-RC1","2014.12","2014.05","2014.01","2013.08"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107837.json","vanir_signatures":[{"id":"CVE-2026-107837-16232dad","signature_type":"Line","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/0cae205cd1d110e0b8fce094714598322d56ce2d","target":{"file":"sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c"},"deprecated":false,"digest":{"line_hashes":["28425923961457656207872185579105990781","120241915219534454861488486735082384643","79928265154049323980788402254745912523","74450740251760192143420873985435767725"],"threshold":0.9}},{"id":"CVE-2026-107837-46102004","signature_type":"Function","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/0cae205cd1d110e0b8fce094714598322d56ce2d","target":{"file":"sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c","function":"_receive"},"deprecated":false,"digest":{"function_hash":"273274595696210877300947620346216307940","length":1959}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/riot-os/riot/commit/0cae205cd1d110e0b8fce094714598322d56ce2d","target":{"file":"sys/include/net/gnrc/sixlowpan.h"},"deprecated":false,"digest":{"line_hashes":["157616998904770304068523081400192147262","125091049534551526924999141310772826721","85452627459648544223717132772677482670"],"threshold":0.9},"id":"CVE-2026-107837-881f999f"}],"vanir_signatures_modified":"2026-10-11T07:04:25Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}]}