Executive brief
RIOT OS, an operating system for Internet of Things (IoT) devices, contains a security flaw in its 'ethos' utility, which is used for serial communication. An attacker can send specially crafted data to a device to cause a system crash or potentially take control of the device. This could lead to service disruptions or unauthorized access to sensitive IoT infrastructure.
Technical details
A stack-based buffer overflow exists in the RIOT OS 'ethos' utility within the _handle_char() function. The vulnerability is caused by a lack of bounds checking when appending incoming serial frame bytes to a fixed-size stack buffer (serial->frame). An attacker can exploit this by sending crafted serial or TCP-framed input that exceeds the Maximum Transmission Unit (MTU) size of 9000 bytes. This results in a write past the end of the buffer, leading to memory corruption, application crashes, and potentially arbitrary code execution. The flaw is reachable via network-based TCP-framed input if ethos is configured to listen for remote connections.
Affected products
- RIOT-OS RIOT OS up to and including 2026.01-devel-317
Timeline
- 2026-01-10: disclosed: Initial disclosure on Full Disclosure mailing list
- 2026-01-12: advisory: NVD and VulnCheck advisory published