CVE-2026-49868

CVE ID: CVE-2026-49868

Severity: CRITICAL | CVSS Score: 9.8/10

Severity and score come from CVSS ratings in the National Vulnerability Database (NVD), the NIST repository of standardized vulnerability data.

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parse reply() in sys/net/application layer/dhcpv6/client.c omits minimum-length validation before passing IA PD and IA NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE DHCPV6 CLIENT IA PD is enabled, causing parse ia pd option to read past the option body, size t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.

🔗 View on NVD

Discussion thread created via CVE Daily tracker. Share your analysis, PoCs, mitigations and detections below.