CVE-2026-107837

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.

• CWE-125

• https://github.com/RIOT-OS/RIOT/commit/0cae205cd1d110e0b8fce094714598322d56ce2d
• https://github.com/RIOT-OS/RIOT/pull/22504
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-m8mc-q4p7-p8j3

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107830Jivejdon from commit e0306088 through commit ee67a65e lacks …5.3
• CVE-2026-107831Jivejdon through 5.0 contains a cross-site request forgery v…4.3
• CVE-2026-107833OWASP Coraza WAF is a golang modsecurity compatible web appl…5.9
• CVE-2026-107834OWASP Coraza WAF is a golang modsecurity compatible web appl…5.3
• CVE-2026-107835OWASP Coraza WAF is a golang modsecurity compatible web appl…4
• CVE-2026-107836RIOT is an open-source microcontroller operating system desi…7.1
• CVE-2026-107838RIOT is an open-source microcontroller operating system desi…7.5
• CVE-2026-107839ageLANServer provides a cross-platform web server and launch…7.5
• CVE-2026-107840yopass is a service for securely sharing secrets, passwords,…7.5
• CVE-2026-107841pacioli provides least-privilege governance and a governed a…5.7
• CVE-2026-10786Improper access control in the ticketing integration setting…6.5
• CVE-2026-10787Missing authorization in the deleted user groups API in Devo…4.3