RIOT-OS RIOT any version

RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivity.

Buffer overflows in RIOT

RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add

RIOT-OS vulnerable to Buffer Overflow during IPHC receive

RIOT-OS vulnerable to Packet Type Confusion during IPHC send

RIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass

RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c

RIOT has an Out-of-Bounds Write in nanoCoAP Handler

RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in ethos Serial Frame Parser

RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility

RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments

Ineffective size check due to assert() and buffer overflow in RIOT

Lack of size check and buffer overflow in RIOT

RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all memory available for network packets and thus effectively stopping all network threads from working. This is related to _receive in sys/net/gnrc/transport_layer/tcp/gnrc_tcp_eventloop.c upon receiving an ACK before a SYN.

In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, because sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c has an infinite loop for an unknown zero-length option.

RIOT-OS vulnerable to null pointer dereference during fragment forwarding

RIOT-OS vulnerable to NULL pointer dereference during NHC encoding

RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark

RIOT-OS vulnerable to Null Pointer dereference during IPHC encoding

RIOT-OS vulnerable to Integer Underflow during defragmentation

RIOT-OS vulnerable to Integer Underflow during IPHC receive

Usage of Uninitialized Timer during forwarding of Fragments with SFR

RIOT-OS missing dhcpv6_opt_t minimum header length check

Spoofed length byte traps CC2538 in endless loop

RIOT-OS vulnerable to Race Condition in SFR Timeout

RIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass

RIOT-OS vulnerable to Out of Bounds write in routing with SRH