PT-2025-51877 · Riot · Riot

Nils-Bernsdorf · Published 2025-12-17 · Updated 2026-01-22 · CVE-2025-66646

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RIOT versions prior to 2025.10

Description RIOT is an open-source microcontroller operating system designed for Internet of Things (IoT) devices and other embedded systems. A flaw exists in the IPv6 fragmentation reassembly implementation. Specifically, when processing a fragmented IPv6 packet with a fragment offset of 0 and an empty payload, the payload pointer is set to NULL. The implementation then attempts to copy this payload into the reassembly buffer, leading to a NULL pointer dereference and causing the operating system to crash, resulting in a denial-of-service (DoS). To exploit this, the gnrc ipv6 ext frag module must be enabled, and an attacker needs to be able to send arbitrary IPv6 packets to the target device.

Recommendations Update to RIOT version 2025.10 or later.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-66646

GHSA-V8GX-Q9M6-5XM9

Affected Products

Riot

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66646.json · Exploit
• 🔥❌ https://github.com/user-attachments/files/23903992/reproducer_1.zip · Exploit, Deleted
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-v8gx-q9m6-5xm9 · Patch
• https://osv.dev/vulnerability/CVE-2025-66646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66646 · Security Note
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L411 · Note
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L532 · Note
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L534 · Note
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L420 · Note
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L490 · Note
• https://github.com/RIOT-OS/RIOT/releases/tag/2025.10 · Note
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L544 · Note
• https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L150C1-L150C76 · Note
• https://t.me/CVEtracker/40072 · Telegram Post
• https://t.me/cveNotify/149579 · Telegram Post