CVE-2025-66646 | THREATINT

Description

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving an fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL. However, the implementation still tries to copy the payload into the reassembly buffer, resulting in a NULL pointer dereference which crashes the OS (DoS). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be enabled and the attacker must be able to send arbitrary IPv6 packets to the victim. RIOT OS v2025.10 fixes the issue.

PUBLISHED Reserved 2025-12-05 | Published 2025-12-17 | Updated 2025-12-17 | Assigner GitHub_M

LOW: 1.7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

Problem types

CWE-476: NULL Pointer Dereference

Product status

< 2025.10

affected

References

github.com/...S/RIOT/security/advisories/GHSA-v8gx-q9m6-5xm9

github.com/...twork_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c

github.com/...ys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c

github.com/RIOT-OS/RIOT/releases/tag/2025.10

github.com/user-attachments/files/23903992/reproducer_1.zip

cve.org (CVE-2025-66646)

nvd.nist.gov (CVE-2025-66646)

Download JSON

help @ threatint.eu