CVE-2025-66647

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force the creation of a small reassembly buffer by first sending a shorter fragment (also with offset=0). Overflowing the reassembly buffer corrupts the state of other packet buffers which an attacker might be able to used to achieve further memory corruption (potentially resulting in remote code execution). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be included and the attacker must be able to send arbitrary IPv6 packets to the victim. Version 2025.10 fixes the issue.

• CWE-120

• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L411Product
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L481Product
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L532Product
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L544Product
• https://github.com/RIOT-OS/RIOT/releases/tag/2025.10Release Notes
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-wh3v-q6vr-j79rExploit, Patch, Vendor Advisory

Published

Dec 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66633An out-of-bounds read vulnerability exists in the EMF functi…7.1
• CVE-2025-66635Stack-based buffer overflow vulnerability exists in SEIKO EP…8.6
• CVE-2025-6664A vulnerability, which was classified as problematic, was fo…4.3
• CVE-2025-66644Array Networks ArrayOS AG before 9.4.5.9 allows command inje…9.8
• CVE-2025-66645NiceGUI is a Python-based UI framework. Versions 3.3.1 and b…7.5
• CVE-2025-66646RIOT is an open-source microcontroller operating system, des…7.5
• CVE-2025-66648vega-functions provides function implementations for the Veg…6.1
• CVE-2025-66649Rejected reason: Further research determined the issue is no…
• CVE-2025-6665A vulnerability has been found in code-projects Inventory Ma…9.8
• CVE-2025-6666A vulnerability was determined in motogadget mo.lock Ignitio…2
• CVE-2025-66660Insufficient parameter sanitization in TEE SOC Driver could …1.8
• CVE-2025-66664Insufficient parameter sanitization in AMD Secure Processor …4.6