CVE-2026-25139 is a critical flaw (CVSS 9.1) in RIOT, the open source operating system for IoT and embedded devices. The 6LoWPAN stack reads fragment headers without checking that the packet is long enough, so a short frame can read adjacent memory or crash the device. It affects version 2025.10 and prior, and no patch was listed at publication.
What's affected
- Affected: RIOT 2025.10 and prior, when running the 6LoWPAN stack.
- Fixed in: the advisory lists no patched version. Check the RIOT repository and release notes for a fix before you rely on any version.
The advisory says the receive path hands a frame to the selective fragment recovery code, which casts the payload to a header structure and reads its fields without first checking the payload length.
How to check if you're exposed
Work out whether your firmware uses RIOT's GNRC 6LoWPAN stack with selective fragment recovery. Look at your build configuration and module list. If your devices use a different network stack, or do not use 6LoWPAN, this CVE does not describe your build.
Then find the RIOT version in your firmware build. Embedded projects often pin an old release, so look at the pinned submodule or the vendored copy.
What to do now
- Identify every product that ships RIOT with the 6LoWPAN stack and the fragment recovery feature.
- Watch the RIOT repository and advisory for a fix, and plan a firmware update when it lands.
- In the meantime, limit who can send frames to the devices. Use link layer security and network segmentation where your deployment supports them.
- Add a length check yourself if you maintain a fork and can ship a patch, following the advisory's description of the missing validation.
- Tell device owners that a firmware update is coming, so they can plan it.
Why it matters
This is a plain bounds problem. The code assumes an incoming packet is large enough for the structure it is cast to. The class is CWE-125 (Out-of-bounds Read). In the advisory's words, a short or malformed frame can cause out of bounds reads when those fields are accessed, with consequences ranging from a leak of adjacent memory to a crash on strict architectures.
Embedded devices live long and update rarely. A flaw with no patch is a watch item. Track it, reduce who can reach the radio interface, and be ready to ship firmware.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a fix available?
Not according to the advisory, which lists no patched versions. Check the project for newer information.
Is CVE-2026-25139 exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the advisory does not report exploitation.
Sources
Last reviewed: 19 October 2026.
