# CVE-2026-107836: RIOT nanoCoAP client buffer underflow in blockwise transfer

Source: https://junglewise.ai/threats/cve-2026-107836-riot-is-an-open-source-microcontroller-operating-system-designed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107836 · Severity: info · Published 2026-10-09

RIOT is an open-source operating system for IoT and embedded microcontroller devices. The nanoCoAP client implementation fails to validate block size parameters from malicious CoAP servers, allowing an attacker to trigger a buffer underflow that reads adjacent memory and crashes the client, causing denial of service and potential information exposure.

Technologies: [Riot-Os Riot](https://junglewise.ai/threats/technologies/riot). Vendors: [Riot-Os](https://junglewise.ai/threats/vendors/riot-os).

## Quick answers

**Is CVE-2026-107836 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107836 being exploited in the wild.

**How severe is CVE-2026-107836?** Informational severity, published 9 October 2026.

**Which products and versions are affected?** Riot-Os Riot 2026.07 and earlier.

**Is there a fix for CVE-2026-107836?** A patch was published on 2026-08-01: fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107836 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-107836?** Check whether you run Riot-Os Riot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The nanocoap_sock_get_slice() function accepts Block2 responses based only on block number without verifying that the server-controlled block size (szx) and derived offset match the requested geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the offset calculation to underflow in _2buf_slice(), reading before the payload buffer boundary and potentially crashing the device or exposing adjacent memory.

## Affected products

- RIOT-OS RIOT 2026.07 and earlier

## Timeline

- 2026-10-09: disclosed
- 2026-08-01: patched: fix committed to master branch

## References

- [https://github.com/RIOT-OS/RIOT/commit/49b894cbe091510093273b98d92c4a17167d6839](https://github.com/RIOT-OS/RIOT/commit/49b894cbe091510093273b98d92c4a17167d6839)
- [https://github.com/RIOT-OS/RIOT/pull/22518](https://github.com/RIOT-OS/RIOT/pull/22518)

## Related threats

- [RIOT DHCPv6 client out-of-bounds heap read](https://junglewise.ai/threats/cve-2026-49868-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanocoap integer overflow in Block2 option parsing](https://junglewise.ai/threats/cve-2026-102692-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanocoap_fileserver assertion failure in response handling](https://junglewise.ai/threats/cve-2026-107838-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT operating system out-of-bounds read in 6LoWPAN fragment handling](https://junglewise.ai/threats/cve-2026-107837-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT OS stack overflow in ethos serial frame parser](https://junglewise.ai/threats/cve-2026-22214-riot-os-stack-overflow-in-ethos-serial-frame-parser)