PatchTheCVECVE-2025-66647: RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Thi
CVE-2025-66647 is a critical-severity flaw (CVSS 9.8) affecting riot. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force the creation of a small reassembly buffer by first
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.0% (top 38%) |
| CISA exploited list | No |
| Weakness | CWE-120 |
| Published | 2025-12-17 |
| Last modified | 2026-10-13 |
Last updated 2026-10-13 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-66647?
riot: upgrade to 2025.10. Exact commands for each OS are on this page.
Is CVE-2025-66647 being exploited?
CVE-2025-66647 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-66647 affect?
CVE-2025-66647 affects riot. Severity is critical (CVSS 9.8). RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation o
How urgent is CVE-2025-66647?
Priority 60/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-66646 HIGH 7.5 UPGRADE RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Thi
- CVE-2026-22214 CRITICAL 9.8 UPGRADE RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in
- CVE-2026-22213 CRITICAL 9.8 UPGRADE RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in
- CVE-2026-25139 CRITICAL 9.1 UPGRADE RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Thi
- CVE-2025-53888 CRITICAL 9.8 UPGRADE RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implement