CERT24CVE-2026-49868 — RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap readLoading data…
CERT24Threat Observatory
Period

CVE-2026-49868 — RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

The RIOT DHCPv6 client function _parse_reply() lacks a sub-option length check, leading to a size_t underflow and an unbounded out-of-bounds heap read.

← Back to intelligence

CVE-2026-49868 — RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

The RIOT DHCPv6 client function _parse_reply() lacks a sub-option length check, leading to a size_t underflow and an unbounded out-of-bounds heap read.