Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to read adjacent memory locations, or crash a vulnerable device running the 6LoWPAN stack. The received packet is cast into a sixlowpan_sfr_rfrag_t struct and dereferenced without validating the packet is large enough to contain the struct object. At time of publication, no known patch exists.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25139 Out-of-Bounds Read Vulnerability in RIOT OS 2025.10 6LoWPAN Stack https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25139
Post summary
CVE-2026-25139, an Out-of-Bounds Read vulnerability in RIOT OS 2025.10 6LoWPAN stack, has been disclosed, but no PoC, exploit, patch, or active exploitation information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | riot-os | riot | - | - | - |