{"vulnerability": "cve-2026-107836", "sightings": [{"uuid": "8941f548-4e4a-4d51-a281-90ba1a5df5b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107836", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412232817123814", "content": "CVE-2026-107836 RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this review.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107836https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-x924-p5fq-26pchttps://github.com/RIOT-OS/RIOT/pull/22518https://github.com/RIOT-OS/RIOT/commit/49b894cbe091510093273b98d92c4a17167d6839#RIOT-OS #RIOT#CVE_2026_107836#bot", "creation_timestamp": "2026-10-09T17:54:54.366877Z"}]}