CVE-2026-11809
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The UpdateHub OTA client in Zephyr OS contains an uninitialized heap memory read and out-of-bounds read in z_impl_updatehub_probe(). A malicious UpdateHub server can send a crafted response that, after a failed first JSON parse, uses a non-NUL-terminated metadata_copy buffer, leading to a read past the allocated memory and potentially crashing the device.
Risk Assessment
An attacker (malicious or compromised UpdateHub server, or without optional CONFIG_UPDATEHUB_DTLS also an on-path attacker) can remotely trigger a denial of service (DoS) by causing a fault and device restart. No direct information disclosure, but the crash can disrupt system operation.
Recommendation
Apply the vendor-provided fix immediately, which zeroes the metadata_copy buffer before copying (memset), ensuring NUL termination and bounding strlen() within the allocation. If the fix is unavailable, consider enabling CONFIG_UPDATEHUB_DTLS and limiting trust in the UpdateHub server.
Other vulnerabilities in Zephyr OS
See all- CVE-2026-17052High
The Time-aware GPIO driver in Zephyr OS lacks validation of output pointers in the tgpio_pin_read_ts_ec() syscall, allowing an unprivileged thread to write to arbitrary kernel memory. The vulnerability only affects builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y, and practical exposure is limited by build issues in some versions.
- CVE-2026-15893Medium
In Zephyr OS, the net_if_ipv6_calc_reachable_time() function in subsys/net/ip/net_if.c incorrectly calculates the neighbor reachable time when base_reachable_time is 1, resulting in a value of 0. An attacker can send an unauthenticated Router Advertisement with the Reachable Time field set to 1, causing the reachable time to be zeroed. Consequently, when a neighbor is confirmed reachable, a kernel assertion may occur (if CONFIG_ASSERT is enabled) or the timer fires immediately, leading to constant re-solicitation and degradation of Neighbor Discovery.
- CVE-2026-13216Medium
The virtio PCI driver in Zephyr OS (drivers/virtio/virtio_pci.c) improperly validates the capability length (cap_len) read from PCI configuration space. The lack of runtime validation (assert is disabled in production builds) leads to an out-of-bounds write on the kernel stack during device initialization.
- CVE-2026-11368High
A vulnerability in the ATT layer of the Bluetooth stack in Zephyr OS leads to a use-after-free of channel memory. When a remote device disconnects during ongoing ATT traffic, a deferred callback may reference a freed channel, causing a system crash or potential memory corruption.
- CVE-2026-10677Medium
In Zephyr OS (versions v1.12.0 through v4.4.1), the CONFIG_USERSPACE syscall verifier in z_vrfy_k_poll() does not free memory on validation failure. An attacker can repeatedly trigger a memory leak, exhausting the kernel pool and causing denial of service.
- CVE-2026-10674Medium
In Zephyr OS (since v2.5.0), the NXP LPUART driver disables peripheral clocks before validating configuration. Unsupported parameters cause an error without re-enabling the clock, leading to a hard fault and system crash.
- CVE-2026-10666High
A stack buffer overflow vulnerability exists in the parse_ipv4() function in Zephyr OS. An attacker can craft an IP address with a long suffix after the colon, causing data to be copied beyond the allocated 17-byte buffer. The issue has been present since v1.9.0 through v4.4.0 and can lead to system crashes or potential control-flow hijack.
- CVE-2026-10657Low
In Zephyr OS, a vulnerability in the DNS resolver uses memcmp() to always compare 7 bytes with the ".local" suffix, even when the final hostname label is shorter. This causes an out-of-bounds read past the string terminator, potentially leading to a page fault and denial of service (DoS). The flaw is present only when CONFIG_MDNS_RESOLVER is enabled and exists since v1.10.0.
- CVE-2026-10656Medium
The MAX32xxx USB device controller driver (udc_max32.c) in Zephyr OS does not check if the endpoint buffer is NULL in the OUT and IN transfer-completion handlers. When a USB host sends a new SETUP packet during an ongoing EP0 transfer, the FIFO can be drained, causing a stale event to be processed, leading to a near-NULL pointer dereference and device crash.
- CVE-2026-10648Medium
In Zephyr OS, the mcumgr_serial_process_frag() function calls net_buf_reset() on the result of smp_packet_alloc() before checking for NULL. When the MCUmgr packet pool (default 4 buffers) is exhausted, smp_packet_alloc() returns NULL, and writing through the NULL pointer causes a system crash.
Original NVD description (English source)
The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS