CVE-2026-15892
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In CVE-2026-15892, the mcumgr settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() allocate a key_name buffer (and a data buffer for read) via k_malloc() when CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP is enabled. When CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK is also enabled and the application access hook rejects a request by returning MGMT_CB_ERROR_RC, the handler executes return ret_rc directly, bypassing the end: label and k_free(), leaking the heap allocation on every rejected request.
Risk Assessment
An attacker can send settings read/write/delete commands over the unauthenticated SMP transport (Bluetooth LE, UART, or UDP) that the hook rejects, monotonically exhausting the kernel heap until k_malloc() fails. This causes a denial of service for mcumgr and any other heap consumer on the device; the impact is availability-only, with no memory corruption or information disclosure.
Recommendation
Update to a version containing the fix that ensures the allocation is freed before returning the access hook error. If updating is not possible, consider disabling CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK or changing the hook to not return MGMT_CB_ERROR_RC, and restrict access to the SMP transport.
Related vulnerabilities
- CVE-2026-88800Critical
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce. The guard meant to protect roles with assigned users reads a different part of the request than the one selecting what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, permanently stripping every user of their capabilities.
- CVE-2026-120844Critical
Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3 allows Privilege Escalation.
- CVE-2026-119516Critical
Deserialization of Untrusted Data vulnerability in Radius Booking — Booking Calendar for Appointments & Services through 1.0.20 allows Object Injection.
- CVE-2026-118423Critical
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
- CVE-2026-63774Critical
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.
- CVE-2026-63017Critical
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
- CVE-2026-77596Critical
In Kubeflow Pipelines prior to 2.18.0, the multi-user HTTP endpoints for uploading pipelines and pipeline versions skip SubjectAccessReview when the target namespace is empty and REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission. If the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass.
- CVE-2026-119757Critical
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND node. The exposed macaroon can be used to gain full control of the LND node, including moving funds, resulting in theft of funds.
- CVE-2026-111494Critical
The MatchPoint Android app incorrectly validates TLS certificates due to a TrustManager that accepts any certificate and a permissive hostname validator. The app also allows unencrypted HTTP traffic, enabling an attacker who intercepts traffic to read and modify communications, including credentials and personal data.
- CVE-2026-111490Critical
An insecure direct object reference (IDOR) vulnerability in the MatchPoint API relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and physical-access QR codes, as well as modification of third-party accounts, password changes, impersonation, and virtual balance transfers.
Original NVD description (English source)
The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c allocate a key_name buffer (and, for read, a data buffer) via k_malloc() when CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP is enabled, relying on the end: label to k_free() them. When CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK is also enabled and the application access hook rejects a request by returning status MGMT_CB_ERROR_RC, the handler executed return ret_rc; directly, bypassing end: and leaking the heap allocation on every rejected request. The settings handlers are reachable over the unauthenticated SMP transport (Bluetooth LE, UART, or UDP, depending on product configuration). The access hook is the mechanism applications use to deny unauthorized settings access, and MGMT_CB_ERROR_RC is a common rejection style, so an attacker who can send settings read/write/delete commands that the hook rejects triggers a heap leak on each attempt. Because the leaked memory is never reclaimed until reboot, a sustained stream of rejected requests monotonically exhausts the kernel heap until k_malloc() fails, denying mcumgr service and impacting any other heap consumer on the device — a denial of service. The impact is availability-only; there is no memory corruption or information disclosure. Only configurations that select the heap buffer type, enable the access hook, and register a hook that returns MGMT_CB_ERROR_RC are affected (the default stack buffer type cannot leak).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS