CVE-2026-49868 RIOT-OS CVE debrief

Who should care

Defenders of IoT and embedded systems using the RIOT operating system should assess exposure and apply patches or compensating controls. This vulnerability can be exploited by malicious DHCPv6 servers to crash devices and potentially expose or corrupt memory.

Why it matters

CVE-2026-49868 is a critical vulnerability in RIOT that allows malicious DHCPv6 servers to crash devices and potentially expose or corrupt memory. Defenders of IoT and embedded systems using RIOT should assess exposure, apply patches or compensating controls, and monitor for suspicious activity.

• Device crashes and potential memory exposure or corruption
• Need for immediate patching or compensating controls
• Potential for exploitation by malicious DHCPv6 servers
• Verification of device versions and exposure required

Technical summary

The _parse_reply() function in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the device and may expose or corrupt memory.

Defensive priority

High

Recommended defensive actions

• Immediately assess exposure of RIOT-based IoT and embedded systems to untrusted DHCPv6 servers
• Verify if devices are running versions prior to 2026.07 and apply patches
• Implement compensating controls such as restricting access to trusted DHCPv6 servers
• Monitor for suspicious DHCPv6 activity and crashes
• Conduct an inventory of all RIOT-based systems
• Review and update change management processes to include verification of RIOT version
• Track and verify patch deployment for all affected systems

Evidence notes

The vulnerability is caused by the _parse_reply() function in sys/net/application_layer/dhcpv6/client.c omitting minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.