Is CVE-2023-50926 actively exploited?

No active exploitation of CVE-2023-50926 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-50926 be exploited remotely?

Yes. CVE-2023-50926 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-50926?

CVE-2023-50926 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2023-50926

HIGH

CVE-2023-50926

CWE-125Published: February 14, 2024· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message contains a field that specifies the length of an IPv6 address prefix. The value of this field is not validated, which means that an attacker can set a value that is longer than the maximum prefix length. Subsequently, a memcmp function call that compares different prefixes can be called with a length argument that surpasses the boundary of the array allocated for the prefix, causing an out-of-bounds read. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in the next release. Users are advised to update as soon as they are able to or to manually apply the changes in Contiki-NG pull request #2721.

NVD Source

Technical Analysis

CVE-2023-50926 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.