CVE-2026-11809
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The UpdateHub OTA client in Zephyr OS contains an uninitialized heap memory read and out-of-bounds read in z_impl_updatehub_probe(). A malicious UpdateHub server can send a crafted response that, after a failed first JSON parse, uses a non-NUL-terminated metadata_copy buffer, leading to a read past the allocated memory and potentially crashing the device.
Risk Assessment
An attacker (malicious or compromised UpdateHub server, or without optional CONFIG_UPDATEHUB_DTLS also an on-path attacker) can remotely trigger a denial of service (DoS) by causing a fault and device restart. No direct information disclosure, but the crash can disrupt system operation.
Recommendation
Apply the vendor-provided fix immediately, which zeroes the metadata_copy buffer before copying (memset), ensuring NUL termination and bounding strlen() within the allocation. If the fix is unavailable, consider enabling CONFIG_UPDATEHUB_DTLS and limiting trust in the UpdateHub server.
Other vulnerabilities in Zephyr OS
See all- CVE-2026-76788High
Stack buffer overflow vulnerability in the OSDP Control Panel reply parser cp_decode_response() in Zephyr OS. For REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame without an upper bound check, allowing writes past the fixed 64-byte arrays in struct osdp_event. Requires CONFIG_OSDP in CP mode and a registered event callback.
- CVE-2026-19737Medium
Vulnerability in the I2S driver for Espressif (ESP32) chips in Zephyr OS. The i2s_esp32_trigger_check() function does not validate stream pointers for RX/TX directions, leading to NULL dereference when only one direction is configured. An unprivileged user-mode thread can call i2s_trigger() with an unsupported direction and cause a kernel panic (denial of service).
- CVE-2026-17052High
The Time-aware GPIO driver in Zephyr OS lacks validation of output pointers in the tgpio_pin_read_ts_ec() syscall, allowing an unprivileged thread to write to arbitrary kernel memory. The vulnerability only affects builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y, and practical exposure is limited by build issues in some versions.
- CVE-2026-15893Medium
In Zephyr OS, the net_if_ipv6_calc_reachable_time() function in subsys/net/ip/net_if.c incorrectly calculates the neighbor reachable time when base_reachable_time is 1, resulting in a value of 0. An attacker can send an unauthenticated Router Advertisement with the Reachable Time field set to 1, causing the reachable time to be zeroed. Consequently, when a neighbor is confirmed reachable, a kernel assertion may occur (if CONFIG_ASSERT is enabled) or the timer fires immediately, leading to constant re-solicitation and degradation of Neighbor Discovery.
- CVE-2026-13216Medium
The virtio PCI driver in Zephyr OS (drivers/virtio/virtio_pci.c) improperly validates the capability length (cap_len) read from PCI configuration space. The lack of runtime validation (assert is disabled in production builds) leads to an out-of-bounds write on the kernel stack during device initialization.
- CVE-2026-11368High
A vulnerability in the ATT layer of the Bluetooth stack in Zephyr OS leads to a use-after-free of channel memory. When a remote device disconnects during ongoing ATT traffic, a deferred callback may reference a freed channel, causing a system crash or potential memory corruption.
- CVE-2026-10677Medium
In Zephyr OS (versions v1.12.0 through v4.4.1), the CONFIG_USERSPACE syscall verifier in z_vrfy_k_poll() does not free memory on validation failure. An attacker can repeatedly trigger a memory leak, exhausting the kernel pool and causing denial of service.
- CVE-2026-10674Medium
In Zephyr OS (since v2.5.0), the NXP LPUART driver disables peripheral clocks before validating configuration. Unsupported parameters cause an error without re-enabling the clock, leading to a hard fault and system crash.
- CVE-2026-10666High
A stack buffer overflow vulnerability exists in the parse_ipv4() function in Zephyr OS. An attacker can craft an IP address with a long suffix after the colon, causing data to be copied beyond the allocated 17-byte buffer. The issue has been present since v1.9.0 through v4.4.0 and can lead to system crashes or potential control-flow hijack.
- CVE-2026-10657Low
In Zephyr OS, a vulnerability in the DNS resolver uses memcmp() to always compare 7 bytes with the ".local" suffix, even when the final hostname label is shorter. This causes an out-of-bounds read past the string terminator, potentially leading to a page fault and denial of service (DoS). The flaw is present only when CONFIG_MDNS_RESOLVER is enabled and exists since v1.10.0.
Original NVD description (English source)
The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS