What’s Vulnerable › Products

RIOT-OS RIOT vulnerabilities

46 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your RIOT-OS RIOT version is affected

Latest RIOT-OS RIOT vulnerabilities

• CVE-2026-49868 — RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read (CVSS 9.8)
• CVE-2026-102693 — RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID (CVSS 9.6)
• CVE-2026-102692 — RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access (CVSS 9.1)
• CVE-2026-107838 — RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion (CVSS 7.5)
• CVE-2026-107837 — RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling (CVSS 8.2)
• CVE-2026-107836 — RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size (CVSS 7.1)
• CVE-2026-27703 — RIOT has an Out-of-Bounds Write in nanoCoAP Handler (CVSS 9.8)
• CVE-2026-25139 — RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments (CVSS 9.1)
• CVE-2026-22214 — RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in ethos Serial Frame Parser (CVSS 9.8)
• CVE-2026-22213 — RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility (CVSS 9.8)
• CVE-2025-66647 — RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass (CVSS 9.8)
• CVE-2025-66646 — RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass (CVSS 7.5)
• CVE-2025-53888 — RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c (CVSS 9.8)
• CVE-2024-53980 — Spoofed length byte traps CC2538 in endless loop (CVSS 7.5)
• CVE-2024-52802 — RIOT-OS missing dhcpv6_opt_t minimum header length check (CVSS 7.5)
• CVE-2024-32018 — Ineffective size check due to assert() and buffer overflow in RIOT (CVSS 9.0)
• CVE-2024-32017 — Buffer overflows in RIOT (CVSS 9.0)
• CVE-2024-31225 — Lack of size check and buffer overflow in RIOT (CVSS 9.0)
• CVE-2023-33975 — RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add (CVSS 9.8)
• CVE-2023-33974 — RIOT-OS vulnerable to Race Condition in SFR Timeout (CVSS 5.9)
• CVE-2023-33973 — RIOT-OS vulnerable to NULL pointer dereference during NHC encoding (CVSS 7.5)
• CVE-2023-24826 — Usage of Uninitialized Timer during forwarding of Fragments with SFR (CVSS 7.5)
• CVE-2023-24825 — RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark (CVSS 7.5)
• CVE-2023-24817 — RIOT-OS vulnerable to Out of Bounds write in routing with SRH (CVSS 7.5)
• CVE-2023-24823 — RIOT-OS vulnerable to Packet Type Confusion during IPHC send (CVSS 9.8)