# CVE-2026-107837: RIOT operating system out-of-bounds read in 6LoWPAN fragment handling

Source: https://junglewise.ai/threats/cve-2026-107837-riot-is-an-open-source-microcontroller-operating-system-designed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107837 · Severity: high · CVSS 8.2 · Published 2026-10-09

RIOT is an open-source microcontroller operating system for IoT and embedded devices. A vulnerability in its 6LoWPAN network layer allows a remote attacker to send a malformed packet fragment that crashes the network stack or exposes memory contents without authentication, potentially disrupting device communication and leaking sensitive data.

Technologies: [Riot-Os Riot](https://junglewise.ai/threats/technologies/riot). Vendors: [Riot-Os](https://junglewise.ai/threats/vendors/riot-os).

## Quick answers

**Is CVE-2026-107837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107837 being exploited in the wild.

**How severe is CVE-2026-107837?** High severity, with a CVSS score of 8.2, published 9 October 2026.

**Which products and versions are affected?** Riot-Os Riot 2026.07 and earlier.

**Is there a fix for CVE-2026-107837?** A patch was published on 2026-07-28: Fix merged to RIOT master branch via commit 0cae205 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107837 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-107837?** Check whether you run Riot-Os Riot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read exists in gnrc_sixlowpan.c's _receive() function where undersized 6LoWPAN fragment packets are passed to gnrc_sixlowpan_frag_recv() without verifying the packet buffer contains the required fragment header bytes. An unauthenticated remote attacker can send a specially crafted 6LoWPAN fragment over the network to trigger memory disclosure or crash the network stack; the fix adds a size validation helper function sixlowpan_frag_is_snip().

## Affected products

- RIOT-OS RIOT 2026.07 and earlier

## Timeline

- 2026-10-09: disclosed
- 2026-07-28: patched: Fix merged to RIOT master branch via commit 0cae205

## References

- [https://github.com/RIOT-OS/RIOT/commit/0cae205cd1d110e0b8fce094714598322d56ce2d](https://github.com/RIOT-OS/RIOT/commit/0cae205cd1d110e0b8fce094714598322d56ce2d)
- [https://github.com/RIOT-OS/RIOT/pull/22504](https://github.com/RIOT-OS/RIOT/pull/22504)

## Related threats

- [RIOT DHCPv6 client out-of-bounds heap read](https://junglewise.ai/threats/cve-2026-49868-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanocoap integer overflow in Block2 option parsing](https://junglewise.ai/threats/cve-2026-102692-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanocoap_fileserver assertion failure in response handling](https://junglewise.ai/threats/cve-2026-107838-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT nanoCoAP client buffer underflow in blockwise transfer](https://junglewise.ai/threats/cve-2026-107836-riot-is-an-open-source-microcontroller-operating-system-designed)
- [RIOT OS stack overflow in ethos serial frame parser](https://junglewise.ai/threats/cve-2026-22214-riot-os-stack-overflow-in-ethos-serial-frame-parser)