CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-25139

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to read adjacent memory locations, or crash a vulnerable device running the 6LoWPAN stack. The received packet is cast into a sixlowpan_sfr_rfrag_t struct and dereferenced without validating the packet is large enough to contain the struct object. At time of publication, no known patch exists.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 25.7%

CVSS Severity

CVSS v3 Score 9.1

References

https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-c8fh-23qr-97mc

Products affected by CVE-2026-25139

Riot-Os » Riot » Version: 2013.08

cpe:2.3:o:riot-os:riot:2013.08
Riot-Os » Riot » Version: 2014.01

cpe:2.3:o:riot-os:riot:2014.01
Riot-Os » Riot » Version: 2014.05

cpe:2.3:o:riot-os:riot:2014.05
Riot-Os » Riot » Version: 2014.12

cpe:2.3:o:riot-os:riot:2014.12
Riot-Os » Riot » Version: 2015.09

cpe:2.3:o:riot-os:riot:2015.09
Riot-Os » Riot » Version: 2015.12

cpe:2.3:o:riot-os:riot:2015.12
Riot-Os » Riot » Version: 2016.04

cpe:2.3:o:riot-os:riot:2016.04
Riot-Os » Riot » Version: 2016.07

cpe:2.3:o:riot-os:riot:2016.07
Riot-Os » Riot » Version: 2016.10

cpe:2.3:o:riot-os:riot:2016.10
Riot-Os » Riot » Version: 2017.01

cpe:2.3:o:riot-os:riot:2017.01
Riot-Os » Riot » Version: 2017.04

cpe:2.3:o:riot-os:riot:2017.04
Riot-Os » Riot » Version: 2017.07

cpe:2.3:o:riot-os:riot:2017.07
Riot-Os » Riot » Version: 2017.10

cpe:2.3:o:riot-os:riot:2017.10
Riot-Os » Riot » Version: 2018.01

cpe:2.3:o:riot-os:riot:2018.01
Riot-Os » Riot » Version: 2018.04

cpe:2.3:o:riot-os:riot:2018.04
Riot-Os » Riot » Version: 2018.07

cpe:2.3:o:riot-os:riot:2018.07
Riot-Os » Riot » Version: 2018.10

cpe:2.3:o:riot-os:riot:2018.10
Riot-Os » Riot » Version: 2018.10.1

cpe:2.3:o:riot-os:riot:2018.10.1
Riot-Os » Riot » Version: 2019.01

cpe:2.3:o:riot-os:riot:2019.01
Riot-Os » Riot » Version: 2019.04

cpe:2.3:o:riot-os:riot:2019.04
Riot-Os » Riot » Version: 2019.07

cpe:2.3:o:riot-os:riot:2019.07
Riot-Os » Riot » Version: 2019.10

cpe:2.3:o:riot-os:riot:2019.10
Riot-Os » Riot » Version: 2020.01

cpe:2.3:o:riot-os:riot:2020.01
Riot-Os » Riot » Version: 2020.01.1

cpe:2.3:o:riot-os:riot:2020.01.1
Riot-Os » Riot » Version: 2020.04

cpe:2.3:o:riot-os:riot:2020.04
Riot-Os » Riot » Version: 2021.01

cpe:2.3:o:riot-os:riot:2021.01
Riot-Os » Riot » Version: 2021.04

cpe:2.3:o:riot-os:riot:2021.04
Riot-Os » Riot » Version: 2021.07

cpe:2.3:o:riot-os:riot:2021.07
Riot-Os » Riot » Version: 2021.10

cpe:2.3:o:riot-os:riot:2021.10
Riot-Os » Riot » Version: 2022.01

cpe:2.3:o:riot-os:riot:2022.01
Riot-Os » Riot » Version: 2022.04

cpe:2.3:o:riot-os:riot:2022.04
Riot-Os » Riot » Version: 2022.07

cpe:2.3:o:riot-os:riot:2022.07
Riot-Os » Riot » Version: 2022.10

cpe:2.3:o:riot-os:riot:2022.10
Riot-Os » Riot » Version: 2023.01

cpe:2.3:o:riot-os:riot:2023.01
Riot-Os » Riot » Version: 2023.04

cpe:2.3:o:riot-os:riot:2023.04
Riot-Os » Riot » Version: 2023.07

cpe:2.3:o:riot-os:riot:2023.07
Riot-Os » Riot » Version: 2023.10

cpe:2.3:o:riot-os:riot:2023.10
Riot-Os » Riot » Version: 2024.01

cpe:2.3:o:riot-os:riot:2024.01
Riot-Os » Riot » Version: 2024.04

cpe:2.3:o:riot-os:riot:2024.04
Riot-Os » Riot » Version: 2024.07

cpe:2.3:o:riot-os:riot:2024.07
Riot-Os » Riot » Version: 2024.10

cpe:2.3:o:riot-os:riot:2024.10
Riot-Os » Riot » Version: 2025.01

cpe:2.3:o:riot-os:riot:2025.01
Riot-Os » Riot » Version: 2025.04

cpe:2.3:o:riot-os:riot:2025.04
Riot-Os » Riot » Version: 2025.07

cpe:2.3:o:riot-os:riot:2025.07
Riot-Os » Riot » Version: 2025.10

cpe:2.3:o:riot-os:riot:2025.10

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-25139

Products

Pricing

Contact Us