Quick answers
- Is CVE-2026-107836 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-107836 being exploited in the wild.
- How severe is CVE-2026-107836?
- Informational severity, published 9 October 2026.
- Which products and versions are affected?
- Riot-Os Riot 2026.07 and earlier.
- Is there a fix for CVE-2026-107836?
- A patch was published on 2026-08-01: fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-107836 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-107836?
- Check whether you run Riot-Os Riot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The nanocoap_sock_get_slice() function accepts Block2 responses based only on block number without verifying that the server-controlled block size (szx) and derived offset match the requested geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the offset calculation to underflow in _2buf_slice(), reading before the payload buffer boundary and potentially crashing the device or exposing adjacent memory.
Affected products
- RIOT-OS RIOT 2026.07 and earlier
Timeline
- 2026-10-09: disclosed
- 2026-08-01: patched: fix committed to master branch