CVE Intelligence
Analysis AI-assisted

CVE-2026-25139: RIOT OS: out-of-bounds read in the 6LoWPAN stack

RIOT, an open-source operating system for IoT and embedded microcontrollers, has multiple out-of-bounds read flaws in its 6LoWPAN stack in version 2025.10 and earlier. An unauthenticated user able to send packets may read adjacent memory or crash a vulnerable device. No known patch existed at publication, and the record does not list this CVE in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

RIOT is an open-source microcontroller operating system designed for Internet of Things (IoT) and other embedded devices. CVE-2026-25139 describes multiple out-of-bounds read conditions in its 6LoWPAN stack in version 2025.10 and earlier, as documented in the GitHub advisory GHSA-c8fh-23qr-97mc. The weakness is classified as CWE-125 (Out-of-bounds Read).

Impact

  • According to the record, an unauthenticated user who can send or manipulate input packets may read adjacent memory or crash a vulnerable device.
  • The NVD CVSS 3.1 base score is 9.1, with a vector indicating high confidentiality and availability impact and no integrity impact.
  • The GitHub CNA assigns a CVSS 4.0 score of 8.7.

Affected products and versions

  • Listed product: Riot-os Riot, versions 2025.10 and prior.
  • The record lists no fixed version.
  • Whether later development builds are affected is unknown from the available data.

Exploitation status

The record marks this CVE as not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted. The record tags the GitHub advisory as 'Exploit' and 'Vendor Advisory'; that tag alone does not confirm that exploitation has occurred. EPSS data is not available.

Remediation and mitigation

  • The record states that no known patch exists at the time of publication. Monitor the vendor advisory for an updated release and apply it as soon as it is available.
  • Inventory devices running RIOT 2025.10 or earlier, prioritizing those with the 6LoWPAN stack enabled.
  • Inference: where 6LoWPAN is not required, disabling it would reduce exposure. Validate this approach against vendor guidance before changing production systems.
  • Restrict network reachability of affected devices from untrusted segments, and segment IoT networks at the perimeter.

Detection guidance

  • Monitor embedded nodes for unexpected reboots, watchdog resets or loss of service, which may indicate crashes.
  • Review network telemetry for unusual or malformed 6LoWPAN traffic arriving from untrusted sources.
  • Correlate device logs with network activity to support triage; detection rules should be tuned to your environment.

Limitations of the available information

  • The record contains no fixed version, patch details, or EPSS score.
  • The conditions that determine whether a read exposes memory or causes a crash are not specified.
  • This analysis relies only on the data in the record and the cited references.

Frequently asked questions

What is the vulnerability in CVE-2026-25139?

It is a set of out-of-bounds read issues in the 6LoWPAN stack of RIOT, an embedded operating system, in version 2025.10 and earlier. Received packets are processed without checking that they are large enough for the expected structure.

Is there a patch available?

The record states that no known patch existed at the time of publication and lists no fixed version. Check the vendor advisory for updates.

Is this CVE being actively exploited?

The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.