CVE-2025-66647 is a buffer overflow in IPv6 fragment reassembly in RIOT OS 2025.07, scored critical (CVSS 9.8) in the record. It needs the gnrc_ipv6_ext_frag module to be built in. Version 2025.10 fixes it. The project advisory rates it medium, so check your firmware.
What's affected
RIOT OS 2025.07 and earlier, per the GitHub advisory, which lists releases up to and including 2025.07 as affected and 2025.10 and later as patched. The record names v2025.07 and says 2025.10 fixes the issue.
Severity differs. The NVD record shows 9.8, critical. The project's own advisory rates it medium. The advisory also narrows the exposure: the gnrc_ipv6_ext_frag module must be compiled in, and the attacker must be able to send arbitrary IPv6 packets to the device. Firmware images that do not include that module are not in the described path.
How to check if you're exposed
RIOT is compiled into firmware, so look at your build, not at a running host. In your application directory, check whether the module is pulled in:
make info-modules | grep -i ipv6_ext_frag
grep -rn "gnrc_ipv6_ext_frag" Makefile *.mk
Also confirm the RIOT release your build uses:
git -C RIOT describe --tags
Remember that a deployed device runs whatever firmware was last flashed. The source tree being updated does not change devices in the field.
What to do now
- List every firmware product built on RIOT and the release each one uses.
- Check each build for the gnrc_ipv6_ext_frag module, directly or as a dependency of another module.
- Update to RIOT 2025.10 or later, rebuild and test IPv6 fragmentation behavior.
- Plan firmware updates for devices in the field, since the fix only helps once it is flashed.
- Where updates will take time, limit which networks can send IPv6 traffic to the devices.
Why it matters
The weakness is CWE-120, a buffer copy without checking the size of the input. According to the advisory, the first fragment is copied into the reassembly buffer with no size check. A shorter fragment sent first causes a small buffer to be created, and a larger later one overflows it and corrupts the state of other packet buffers.
On a microcontroller there is usually no memory protection to contain that damage, which is why the advisory says it could potentially lead to remote code execution. Embedded updates are slow, and vendor firmware often lags the upstream project. The record does not list this CVE as known exploited.
Quick check
Why do the severity ratings differ?
The pages I fetched do not explain the gap. The NVD record says 9.8 and the project advisory says medium, so state both and base your priority on whether the module is in your firmware.
Which release fixes it?
RIOT 2025.10, per the record and the advisory.
Sources
Last reviewed: 18 October 2026.
