CVE-2024-32018

CVE-2024-32018 is a critical buffer overflow vulnerability affecting the RIOT real-time operating system. Specifically, the nimble_scanlist_update() function fails to properly validate the 'len' parameter when assertion macros are compiled out, allowing an attacker to write past the end of a fixed-length buffer. This vulnerability has a CVSS score of 9.0 (Critical) and can lead to denial of service or arbitrary code execution, with a low attack complexity and no user interaction required. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness and potential future exploitation. Users are advised to implement manual 'len' checking as a mitigation since no patch is currently available.