{"id":"CVE-2026-25139","summary":"RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments","details":"RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to read adjacent memory locations, or crash a vulnerable device running the 6LoWPAN stack. The received packet is cast into a sixlowpan_sfr_rfrag_t struct and dereferenced without validating the packet is large enough to contain the struct object. At time of publication, no known patch exists.","aliases":["GHSA-c8fh-23qr-97mc"],"modified":"2026-08-12T03:51:31.497602752Z","published":"2026-02-04T17:47:00.378Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25139.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25139.json"},{"type":"ADVISORY","url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-c8fh-23qr-97mc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25139"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/riot-os/riot","events":[{"introduced":"0"},{"last_affected":"d271fc88a4edbaaaea097717aa1f118700cdbb63"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"2025.10"}]}}],"versions":["2025.10-devel","2025.07-RC1","2025.07-devel","2025.04-RC1","2025.04-devel","2025.01-RC1","2025.01-devel","2024.10-RC1","2024.10-devel","2024.07-RC1","2024.04","2024.07-devel","2024.04-RC1","2024.04-devel","2024.01-RC1","2024.01-devel","2023.10-RC1","2023.10-devel","2023.07-RC1","2023.07-devel","2023.04-RC1","2023.04-devel","2023.01-RC1","2023.01-devel","2022.10-RC1","2022.10-devel","2022.07-RC1","2022.07-devel","2022.04-RC1","2022.04-devel","2022.01-RC1","2022.01-devel","2021.10-RC1","2021.10-devel","2021.07-RC1","2021.07-devel","2021.04-RC1","2021.04-devel","2021.01-RC1","2021.01-devel","2020.10-RC1","2020.10-devel","2020.07-RC1","2020.07-devel","2020.04-RC1","2020.04-devel","2020.01-RC1","2020.01-devel","2019.10-RC1","2019.10-devel","2019.07-RC1","2019.07-devel","2019.04-RC1","2019.04-devel","2019.01-RC1","2018.10-devel","2018.07-RC1","2019.01-devel","2018.10-RC1","2018.07-devel","2018.04-RC1","2018.04-devel","2018.01-RC1","2018.01-devel","2017.10-RC1","2017.10-devel","2017.07-RC1","2017.07-devel","2017.04-RC1","2017.04-devel","2017.01-RC1","2017.01-devel","2016.10-RC1","2016.10-devel","2016.07-RC2","2016.07-RC1","2016.04-RC1","2016.07-devel","2016.03-devel","2015.12-RC1","2015.12-devel","2015.09-RC1","2014.12","2014.05","2014.01","2013.08"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25139.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}