CVE-2026-10672 is a buffer handling vulnerability in the Zephyr project’s LwM2M firmware update subsystem. The firmware-update Package URI is copied into a fixed static buffer of size 128 bytes without validating the length of the source URI, which can be up to 255 bytes. This results in the buffer lacking a null terminator and subsequent functions performing strlen-based operations read beyond the buffer boundary, causing out-of-bounds reads of adjacent static memory. The leaked memory contents are appended to outbound CoAP requests, potentially disclosing sensitive device memory to a management server or an on-path attacker. Additionally, this can cause device crashes (denial of service). The vulnerability was introduced in version 3.0.0 and persists through version 4.4.0 when the default CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT is enabled. The fix involves adding a length check and ensuring the buffer is null-terminated.

An attacker controlling the LwM2M management server or positioned on-path without strong DTLS can supply a crafted Package URI that triggers out-of-bounds reads of adjacent device memory. This leads to information disclosure of potentially sensitive memory contents and can also cause device crashes resulting in denial of service. The vulnerability does not allow code execution or integrity compromise but impacts confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix adds a length check on the URI and ensures null termination of the buffer, preventing out-of-bounds reads. Until an official patch is available, consider disabling the default CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT feature if feasible or restricting access to trusted LwM2M management servers with strong DTLS to prevent exploitation.