CVE-2026-10849 describes a heap-based out-of-bounds write in the hawkBit client component of Zephyr. The client accumulates HTTP response bodies into a heap buffer sized exactly to the received body length but without reserving space for a terminating NUL byte. When the terminator is written, it overwrites one byte past the allocated buffer, corrupting heap metadata or adjacent allocations. This vulnerability is remotely triggerable by a malicious or compromised hawkBit update server controlling the HTTP response length. The corruption can lead to denial of service due to allocator faults or potentially further heap corruption. The flaw affects Zephyr versions from 2.4.0 up to but excluding 4.5.0. The fix involves sizing the buffer to body length plus one and copying with memcpy to ensure the terminator fits within the allocation.

The vulnerability allows a remote attacker controlling the hawkBit update server to cause a heap-based out-of-bounds write in the client. This results in heap corruption that can cause denial of service through faults on subsequent allocations or frees. There is a bounded possibility of further memory corruption depending on the allocator. No confidentiality or integrity impact is explicitly stated. Exploitation requires control over the update server or a man-in-the-middle position, as TLS does not protect against a hostile server and there is no client-side length cap or authentication of response content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by sizing the buffer to the body length plus one and copying with memcpy to ensure the terminating NUL byte is within bounds. Until an official fix is applied, mitigate by ensuring the hawkBit update server is trusted and communications are secured to prevent malicious responses. TLS alone does not guarantee protection against a compromised server. Monitor vendor channels for an official patch or update.