CVE-2026-27703 is a high severity out of bounds write (CVSS 7.5) in RIOT, the open source operating system for IoT devices. The CoAP well-known core handler writes into a fixed buffer without a size check. The advisory lists no patched version, so check upstream for a fix.
What's affected
RIOT 2026.01 and earlier. The advisory page shows the affected range as 2026.01 and below, and lists no patched version at the time of review. We cannot confirm a fixed release, so check the advisory and the RIOT repository for the latest status.
The advisory says the flaw affects users who meet all three conditions:
- They use the nanocoap server implementation.
- They enable and expose the well-known core resource to untrusted clients.
- They support the extended token length feature.
If your firmware does not use the nanocoap server, or does not expose that resource, the specific path is not in play.
How to check if you're exposed
Check your firmware build, since embedded software is usually compiled from a pinned RIOT version.
git -C /path/to/RIOT describe --tags
grep -rn "nanocoap" Makefile
Then check the build configuration for the nanocoap server module and for the response buffer size setting. The advisory says the default buffer is 112 bytes. Also check which network interfaces expose CoAP to untrusted peers.
What to do now
- Inventory devices and firmware images that include RIOT and the nanocoap server.
- Watch the RIOT advisory and repository for a fix, and rebuild and roll out new firmware once one is available.
- Until then, avoid exposing the well-known core resource to untrusted networks, and place CoAP devices behind a gateway or firewall that only allows known peers.
- Disable features you do not use, such as the extended token length support where your build allows it.
- Plan an over the air update path for field devices, since patching embedded fleets takes time.
Why it matters
This is CWE-787, out of bounds write. The advisory walks through it. The server receives a valid packet with a long extended token, parsing only checks that the packet is well formed, and the handler then calculates where to write the response from the packet's own lengths, without checking that the position is still inside the fixed buffer.
On a device with limited memory protection, writing past a stack buffer can overwrite saved addresses. The advisory says this can mean denial of service or, in the worst case, hijacked execution of the server. The record's vector scores integrity impact as high.
Embedded software is hard to patch. The best defences here are network placement and knowing what you ship, which is the job of a software bill of materials for firmware.
Quick check
Is there a fixed RIOT release?
We could not confirm one. The advisory showed no patched version at review time, so check it directly.
Sources
Last reviewed: 19 October 2026.
