CVE-2026-102692

Name of the Vulnerable Software and Affected Versions RIOT versions prior to 2026.07

Description The nanocoap component fails to enforce the 20-bit maximum block number for CoAP Block2 option values. This allows block offset multiplication to overflow on 32-bit targets. The oversized value is passed from the coap get blockopt() function to the coap block slicer init() function. A remote CoAP client can send a malformed Block2 option to produce an invalid slice range, potentially leading to out-of-bounds memory access, denial of service, or memory corruption.

Recommendations Update to version 2026.07.