RIOT-OS up to 2025.9 IPv6 Fragmentation gnrc_ipv6_ext_frag buffer overflow

Summaryinfo

A vulnerability was found in RIOT-OS up to 2025.9 and classified as critical. Affected by this vulnerability is the function gnrc_ipv6_ext_frag of the component IPv6 Fragmentation Handler. Such manipulation leads to buffer overflow. This vulnerability is referenced as CVE-2025-66647. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in RIOT-OS up to 2025.9. It has been rated as critical. Affected by this issue is the function gnrc_ipv6_ext_frag of the component IPv6 Fragmentation Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. CVE summarizes:

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force the creation of a small reassembly buffer by first sending a shorter fragment (also with offset=0). Overflowing the reassembly buffer corrupts the state of other packet buffers which an attacker might be able to used to achieve further memory corruption (potentially resulting in remote code execution). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be included and the attacker must be able to send arbitrary IPv6 packets to the victim. Version 2025.10 fixes the issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-66647 since 12/05/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 2025.10 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• RIOT-OS

Version

• 2025.0
• 2025.1
• 2025.2
• 2025.3
• 2025.4
• 2025.5
• 2025.6
• 2025.7
• 2025.8
• 2025.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion