CVE-2025-53888 is a Critical severity buffer overflow (CVSS 9.8) in RIOT-OS, the operating system for Internet of Things devices. A size check in l2filter_add() uses assert(), which is compiled out in production builds. The upstream fix is commit f6f7de4, so rebuild with it.
What's affected
The advisory says RIOT-OS versions up to and including 2025.04 are affected. The patch is in commit f6f7de4ccc107c018630e4c15500825caf02e1c2.
The record does not name a release that contains the commit, so check the project releases and your own source tree for it. Because RIOT is compiled into firmware, there is no package to update. Every device image built from the affected code needs a rebuild and a new rollout.
The weak code is the link layer address filter, in the file sys/net/link_layer/l2filter/l2filter.c.
How to check if you're exposed
Because this is firmware, check your source and your build settings. First, see which tree and version you build from:
git -C RIOT describe --tags
git -C RIOT log --oneline -1 -- sys/net/link_layer/l2filter/l2filter.c
git -C RIOT branch --contains f6f7de4ccc107c018630e4c15500825caf02e1c2
If the last command shows no branch that you build from, you do not have the fix. Next, find out whether your firmware uses the l2filter module at all, by checking the module list in your application makefile. If it does not, the weak code is not in your image.
What to do now
- Update your RIOT source to a tree that contains commit f6f7de4, or apply the commit to your fork.
- Rebuild every firmware image that includes the l2filter module and roll the new images out to devices.
- Check every place in your own code where an assert is the only check on a value from the network, and replace it with a real check.
- Where you cannot update devices quickly, limit which neighbours can send frames to them.
- Record which device models and firmware builds contained the module, so you can report on coverage.
Why it matters
This is CWE-120, a classic buffer copy without checking the size of the input. The function checks addr_len with an assertion and then uses that value in memcpy(). An assertion is a debugging aid. In production builds assertions are usually compiled out, so the check disappears and an oversized value overruns the buffer.
The advisory explains the effect plainly. If the unchecked value is controlled by an attacker, the result can range from a crash to arbitrary code execution. The fix is to replace the assert with a real runtime check that returns an error.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. Embedded devices are slow to patch, which is why a code level fix may take a long time to reach the field.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does assert matter here?
Asserts are removed in release builds, so a check that relies on one gives no protection on the devices people actually run.
How do I know if my firmware is affected?
Check whether it is built from RIOT 2025.04 or earlier without commit f6f7de4, and whether it includes the l2filter module.
Sources
Last reviewed: 18 October 2026.
