CVE-2025-36939: OpenThread MLE Packet DOS Vulnerability

CVE-2025-36939 Overview

CVE-2025-36939 affects OpenThread, an open-source implementation of the Thread networking protocol used in Internet of Things (IoT) mesh networks. The vulnerability resides in how OpenThread parses Mesh Link Establishment (MLE) packets. An authenticated attacker on the same Thread network can send specially crafted MLE packets to trigger assertion failures and a stack-based buffer overflow [CWE-121]. The result is a denial of service against affected Thread nodes. The flaw carries a CVSS 4.0 base score of 10.0 and was published to the National Vulnerability Database (NVD) on 2026-08-24.

Critical Impact
An authenticated attacker on the same Thread mesh can crash nodes or corrupt stack memory by sending malformed MLE packets, disrupting IoT network availability.

Affected Products

OpenThread (Thread protocol stack implementation)
Devices and firmware embedding vulnerable OpenThread MLE handling code
Thread-enabled IoT products relying on affected OpenThread releases

Discovery Timeline

2026-08-24 - CVE-2025-36939 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2025-36939

Vulnerability Analysis

OpenThread implements the Thread mesh networking protocol for low-power IoT devices. MLE is the control-plane protocol that Thread nodes use to discover neighbors, establish links, and maintain routing state. CVE-2025-36939 aggregates multiple defects in the MLE packet-handling path. These defects include triggerable assertion failures and a stack-based buffer overflow.

An authenticated node on the Thread network can craft MLE frames that violate parser assumptions. Malformed length fields or unexpected TLV (type-length-value) content drive execution into paths that either abort on assertion or write beyond a fixed-size stack buffer. Either outcome halts the target device and disrupts mesh operation.

Root Cause

The primary root cause is insufficient bounds validation on attacker-controlled fields within MLE packets. When the parser copies TLV payloads into stack-allocated buffers without verifying declared length against the destination buffer size, it produces a classic stack-based buffer overflow [CWE-121]. Separately, defensive assertions in the same code paths convert unexpected but reachable states into fatal aborts, providing a reliable denial-of-service primitive.

Attack Vector

Exploitation requires network adjacency on the Thread mesh and valid network credentials, so the attacker must already be authenticated as a Thread node. Once joined, the attacker transmits crafted MLE packets to a peer or router. The target parses the malformed frame and either asserts and reboots or overflows the stack buffer, terminating the process. Repeated transmissions produce sustained denial of service across the mesh. See the Google Product Documentation for the vendor advisory.

// No verified proof-of-concept code is publicly available.
// The vulnerability manifests during MLE TLV parsing when
// an attacker-supplied length field exceeds the destination
// stack buffer, or drives the parser into an asserted state.

Detection Methods for CVE-2025-36939

Indicators of Compromise

Unexpected reboots or assertion-failure logs on Thread nodes, particularly routers and leader devices.
Repeated MLE parse errors or malformed-packet counters incrementing on OpenThread instances.
Loss of mesh connectivity or route churn correlated with a specific joined node sourcing MLE traffic.

Detection Strategies

Enable OpenThread diagnostic logging and monitor for assertion traces originating in MLE parsing functions.
Capture Thread radio traffic with a sniffer and inspect MLE TLV length fields for values that exceed protocol bounds.
Correlate device crash telemetry with the joining time and identity of new Thread nodes to isolate a malicious authenticated peer.

Monitoring Recommendations

Aggregate device crash logs and firmware watchdog resets into a central logging pipeline for trend analysis.
Alert when multiple Thread nodes reboot within a short window, which suggests coordinated MLE-based abuse.
Track the Thread join and commissioning events, so revoked or rogue credentials can be tied to observed denial-of-service activity.

How to Mitigate CVE-2025-36939

Immediate Actions Required

Inventory all IoT devices and border routers running OpenThread and identify the embedded stack version.
Apply firmware updates from device manufacturers that incorporate the patched OpenThread MLE parser.
Rotate Thread network credentials and remove any commissioned devices that are not required or not trusted.
Restrict commissioning to trusted operators to reduce the population of authenticated nodes that could send crafted MLE packets.

Patch Information

Refer to the vendor advisory at Google Product Documentation Support for the fixed OpenThread commits and version guidance. Device vendors that ship OpenThread in firmware should rebuild against the patched upstream and distribute updates through their normal firmware channels.

Workarounds

Segment Thread networks so critical infrastructure devices do not share a mesh with lower-trust endpoints.
Disable open commissioning and require strong out-of-band joiner credentials to limit authenticated attackers.
Monitor and rate-limit MLE traffic at border routers where feasible, and remove suspect nodes promptly.

bash

# No vendor-supplied configuration workaround is published.
# Consult the OpenThread advisory and device vendor guidance
# before applying local mitigations.