Skip to contentRiot-os Riot vulnerabilities
- riot-os riotRIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap readCVE-2026-498689.8 Critical
- riot-os riotRIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSIDCVE-2026-1026939.6 Critical
- riot-os riotRIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory accessCVE-2026-1026929.1 Critical
- riot-os riotRIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertionCVE-2026-1078387.5 High
- riot-os riotRIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment HandlingCVE-2026-1078378.2 High
- riot-os riotRIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block sizeCVE-2026-1078367.1 High
- riot-os riotRIOT has an Out-of-Bounds Write in nanoCoAP HandlerCVE-2026-277037.5 High
- riot-os riotRIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR FragmentsCVE-2026-251398.7 High
- riot os, riot-os riot +1 moreRIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in ethos Serial Frame ParserCVE-2026-222146.8 Medium
- riot os, riot-os riot +1 moreRIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 UtilityCVE-2026-222132.4 Low
- riot-os riotRIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reassCVE-2025-666471.7 Low
- riot-os riotRIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reassCVE-2025-666461.7 Low
- riot-os riotRIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.cCVE-2025-538886.6 Medium
- riot-os riotSpoofed length byte traps CC2538 in endless loopCVE-2024-539806.9 Medium
- riot-os riotRIOT-OS missing dhcpv6_opt_t minimum header length checkCVE-2024-528027.5 High
- riot-os riotIneffective size check due to assert() and buffer overflow in RIOTCVE-2024-320188.8 High
- riot-os riotBuffer overflows in RIOTCVE-2024-320179.8 Critical
- riot-os riotLack of size check and buffer overflow in RIOTCVE-2024-312258.4 High
- riot-os riotRIOT-OS vulnerable to Out of Bounds Write in _rbuf_addCVE-2023-339759.8 Critical
- riot-os riotRIOT-OS vulnerable to Race Condition in SFR TimeoutCVE-2023-339747.5 High
- riot-os riotRIOT-OS vulnerable to NULL pointer dereference during NHC encodingCVE-2023-339737.5 High
- riot-os riotUsage of Uninitialized Timer during forwarding of Fragments with SFRCVE-2023-248265.9 Medium
- riot-os riotRIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_markCVE-2023-248257.5 High
- riot-os riotRIOT-OS vulnerable to Out of Bounds write in routing with SRHCVE-2023-248177.5 High
- riot-os riotRIOT-OS vulnerable to Packet Type Confusion during IPHC sendCVE-2023-248239.8 Critical
- riot-os riotRIOT-OS vulnerable to Null Pointer dereference during IPHC encodingCVE-2023-248227.5 High
- riot-os riotRIOT-OS vulnerable to Integer Underflow during defragmentationCVE-2023-248217.5 High
- riot-os riotRIOT-OS vulnerable to Integer Underflow during IPHC receiveCVE-2023-248207.5 High
- riot-os riotRIOT-OS vulnerable to Buffer Overflow during IPHC receiveCVE-2023-248199.8 Critical
- riot-os riotRIOT-OS vulnerable to null pointer dereference during fragment forwardingCVE-2023-248187.5 High
- riot os, riot-os riot +1 moreRIOT OS Integer Overflow or WraparoundCVE-2021-274277.3 High
- riot-os riotIn RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component...CVE-2021-410615.5 Medium
- riot-os riotRIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow...CVE-2021-316607.5 High
- riot-os riotRIOT-OS 2021.01 before commit 609c9ada34da5546cffb632a98b7ba157c112658 contains a buffer overflow...CVE-2021-316617.5 High
- riot-os riotRIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow...CVE-2021-316627.5 High
- riot-os riotRIOT-OS 2021.01 before commit bc59d60be60dfc0a05def57d74985371e4f22d79 contains a buffer overflow...CVE-2021-316637.5 High
- riot-os riotRIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow...CVE-2021-316647.5 High
- riot-os riotRIOT-OS 2021.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl...CVE-2021-276989.8 Critical
- riot-os riotRIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl...CVE-2021-276979.8 Critical
- riot-os riotRIOT-OS 2020.01 contains a buffer overflow vulnerability in /sys/net/gnrc/routing/rpl...CVE-2021-273579.8 Critical
- riot-os riotRIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode()...CVE-2020-153509.8 Critical
- riot-os riotIn RIOT 2019.07, the MQTT-SN implementation (asymcute) mishandles errors occurring during a read...CVE-2019-173897.5 High
- riot-os riotRIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute),...CVE-2019-167547.5 High
- riot-os riotIn the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not...CVE-2019-157027.5 High
- riot-os riotRIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an...CVE-2019-151347.5 High
- riot-os riotRIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer...CVE-2019-10000069.8 Critical