{"id":"CVE-2026-49868","title":"RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read","summary":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation bef…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-125","CWE-191"],"vendor":"RIOT-OS","product":"RIOT","affected":["RIOT < 2026.07"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T16:50:58.750Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49868","references":[{"url":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-p3fx-9qcg-jmcf","label":"https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-p3fx-9qcg-jmcf"},{"url":"https://github.com/RIOT-OS/RIOT/pull/22322","label":"https://github.com/RIOT-OS/RIOT/pull/22322"},{"url":"https://github.com/RIOT-OS/RIOT/commit/c9830dc5f2a9bf97418de4fc7d7167d00a45df17","label":"https://github.com/RIOT-OS/RIOT/commit/c9830dc5f2a9bf97418de4fc7d7167d00a45df17"},{"url":"https://github.com/RIOT-OS/RIOT/releases/tag/2026.07","label":"https://github.com/RIOT-OS/RIOT/releases/tag/2026.07"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T17:24:46.895Z","slug":"CVE-2026-49868","body":"## Overview\n\nRIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.\n\n## Affected\n\n- `RIOT < 2026.07`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}