PT-2026-24801 · Riot-Os+1 · Riot

Ampaschal · Publicado 2026-03-11 · Atualizado 2026-03-11 · CVE-2026-27703

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RIOT versions 2026.01 and earlier

Description RIOT is an open-source microcontroller operating system designed for Internet of Things (IoT) and embedded devices. A flaw exists in the default handler for the well known core resource, coap well known core default handler. This handler writes user-provided data into a fixed-size buffer without sufficient validation, potentially leading to a buffer overflow. This can allow an attacker to corrupt adjacent stack locations, including the return address, resulting in denial of service or arbitrary code execution. The vulnerable operation involves writing option data and other data into the buffer.

Recommendations Versions prior to 2026.01 should be updated.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2026-27703

GHSA-QGJ4-9JFF-93CJ

Produtos afetados

Riot

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27703.json · Exploit
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-qgj4-9jff-93cj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27703 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031867671705157903 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-27703 · Aviso do Fabricante