---
id: CVE-2026-49868
title: >-
  RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to
  size_t underflow and unbounded OOB heap read
summary: >-
  RIOT is an open-source microcontroller operating system designed for Internet
  of Things devices and other embedded systems. Prior to 2026.07, _parse_reply()
  in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation
  bef…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-125
  - CWE-191
vendor: RIOT-OS
product: RIOT
affected:
  - RIOT < 2026.07
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T16:50:58.750Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49868'
references:
  - url: 'https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-p3fx-9qcg-jmcf'
    label: 'https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-p3fx-9qcg-jmcf'
  - url: 'https://github.com/RIOT-OS/RIOT/pull/22322'
    label: 'https://github.com/RIOT-OS/RIOT/pull/22322'
  - url: >-
      https://github.com/RIOT-OS/RIOT/commit/c9830dc5f2a9bf97418de4fc7d7167d00a45df17
    label: >-
      https://github.com/RIOT-OS/RIOT/commit/c9830dc5f2a9bf97418de4fc7d7167d00a45df17
  - url: 'https://github.com/RIOT-OS/RIOT/releases/tag/2026.07'
    label: 'https://github.com/RIOT-OS/RIOT/releases/tag/2026.07'
tags:
  - cve.org
ingestedAt: '2026-10-16T17:24:46.895Z'
---

## Overview

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory. This issue is fixed in version 2026.07.

## Affected

- `RIOT < 2026.07`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.