# CVE-2026-102692: RIOT nanocoap integer overflow in Block2 option parsing

Source: https://junglewise.ai/threats/cve-2026-102692-riot-is-an-open-source-microcontroller-operating-system-designed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-102692 · Severity: critical · CVSS 9.1 · Published 2026-10-16

RIOT is an operating system for embedded IoT devices that uses nanocoap to handle CoAP (Constrained Application Protocol) network communication. A remote attacker can send a malformed network packet with an oversized Block2 option that causes integer overflow, leading to memory corruption, data exposure, or denial of service on vulnerable devices.

Technologies: [Riot-Os Riot](https://junglewise.ai/threats/technologies/riot). Vendors: [Riot-Os](https://junglewise.ai/threats/vendors/riot-os).

## Quick answers

**Is CVE-2026-102692 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102692 being exploited in the wild.

**How severe is CVE-2026-102692?** Critical severity, with a CVSS score of 9.1, published 16 October 2026.

**Which products and versions are affected?** Riot-Os Riot before 2026.07.

**Is there a fix for CVE-2026-102692?** Yes: fixed in 2026.07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102692 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-102692?** Check whether you run Riot-Os Riot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.07

## Technical details

The nanocoap library fails to enforce the 20-bit maximum for CoAP Block2 option values; oversized values pass through coap_get_blockopt() to coap_block_slicer_init(), where block offset multiplication overflows on 32-bit targets. A remote, unauthenticated attacker on the network can send a malicious CoAP Block2 option to trigger out-of-bounds memory access, denial of service, or memory corruption. The fix adds overflow checks and rejects out-of-spec 4-byte options.

## Affected products

- RIOT-OS RIOT before 2026.07

## Timeline

- 2026-10-16: disclosed
- 2026-07-23: patched

## References

- [https://github.com/RIOT-OS/RIOT/commit/6b283ace3565d931b3edff7e115d4f79339253b8](https://github.com/RIOT-OS/RIOT/commit/6b283ace3565d931b3edff7e115d4f79339253b8)
- [https://github.com/RIOT-OS/RIOT/commit/ee1fa0ef91874494823d476392572aeefdbc6b74](https://github.com/RIOT-OS/RIOT/commit/ee1fa0ef91874494823d476392572aeefdbc6b74)

## Related threats

- [RIOT DHCPv6 client out-of-bounds heap read](https://junglewise.ai/threats/cve-2026-49868-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanocoap_fileserver assertion failure in response handling](https://junglewise.ai/threats/cve-2026-107838-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT operating system out-of-bounds read in 6LoWPAN fragment handling](https://junglewise.ai/threats/cve-2026-107837-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanoCoAP client buffer underflow in blockwise transfer](https://junglewise.ai/threats/cve-2026-107836-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT OS stack overflow in ethos serial frame parser](https://junglewise.ai/threats/cve-2026-22214-riot-os-stack-overflow-in-ethos-serial-frame-parser)