What is CVE-2026-102693?

CVE-2026-102693 is a critical-severity vulnerability in Riot-Os Riot, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 9.6/10. Published 2026-10-16.

How severe is CVE-2026-102693?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Buffer overflow in Riot-Os Riot

CVE-2026-102693

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.

Vulnerability class: Buffer Overflow

Published 2026-10-16 · last modified 2026-10-16.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Riot-Os Riot — versions < 2026.04

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-102693?: CVE-2026-102693 is a critical-severity vulnerability in Riot-Os Riot, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 9.6/10. Published 2026-10-16.
How severe is CVE-2026-102693?: Critical severity. CVSS v3 base score is 9.6 out of 10.