Executive brief
OpenThread is an open-source implementation of the Thread networking protocol used in smart home and IoT devices. A vulnerability in its network translation component (NAT64) allows an attacker on a nearby network to send specially crafted data packets that bypass security checks or corrupt network traffic. This could allow an unauthorized user to inject data into the secure device mesh or interfere with communication between connected devices.
Technical details
The OpenThread NAT64 translator incorrectly assumed a fixed IPv4 header length of 20 bytes. When an IPv4 packet with options (where the Internet Header Length is greater than 5) was processed, the translator would read transport headers from the wrong offset, leading to the corruption of UDP/TCP fields. Furthermore, the translator failed to remove the IPv4 options, leaving them at the start of the translated IPv6 payload, and bypassed mandatory RFC 7915 security checks for Source Route options (LSRR/SSRR). An attacker on the adjacent IPv4 network can exploit this to inject corrupted traffic into the Thread mesh or bypass security filters. The issue was addressed by updating the Ip4::Header class to validate IHL and ensuring the translator uses the actual header length.
Affected products
- The OpenThread Authors OpenThread before commit 26a882d
Timeline
- 2026-04-01: other: Fix proposed in GitHub Pull Request #12818
- 2026-04-02: patched: Fix merged into main branch
- 2026-05-13: advisory: CVE-2026-8369 published