PT-2026-24801 · Riot-Os+1 · Riot

Ampaschal · Published 2026-03-11 · Updated 2026-03-11 · CVE-2026-27703

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RIOT versions 2026.01 and earlier

Description RIOT is an open-source microcontroller operating system designed for Internet of Things (IoT) and embedded devices. A flaw exists in the default handler for the well known core resource, coap well known core default handler. This handler writes user-provided data into a fixed-size buffer without sufficient validation, potentially leading to a buffer overflow. This can allow an attacker to corrupt adjacent stack locations, including the return address, resulting in denial of service or arbitrary code execution. The vulnerable operation involves writing option data and other data into the buffer.

Recommendations Versions prior to 2026.01 should be updated.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-27703

GHSA-QGJ4-9JFF-93CJ

Affected Products

Riot

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27703.json · Exploit
• https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-qgj4-9jff-93cj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27703 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27703 · Vendor Advisory
• https://twitter.com/CVEnew/status/2031867671705157903 · Twitter Post