CVE-2026-11809: memory-safety in zephyrproject zephyr
The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.
AI Analysis
Technical Summary
The UpdateHub OTA client in Zephyr's subsys/mgmt/updatehub/updatehub.c has a memory safety issue in z_impl_updatehub_probe(). When the probe response from the UpdateHub server is copied into a heap buffer (metadata) and then into a second uninitialized buffer (metadata_copy) without zeroing, the strlen() call on metadata_copy can read past the allocated buffer if no terminating NUL byte is found. This leads to an out-of-bounds read of uninitialized heap memory. The probe payload is attacker-controlled, allowing a crafted payload to trigger this condition. The impact is a network-triggerable denial of service via a crash of the update thread or device. The vulnerability does not cause information disclosure or memory corruption. The fix involves zeroing metadata_copy before copying to ensure proper NUL termination and bounded strlen().
Potential Impact
An attacker controlling or intercepting the UpdateHub server response can cause the UpdateHub client to read uninitialized heap memory beyond the allocated buffer, potentially causing a crash of the update thread or the entire device. This results in a denial of service condition. There is no direct information disclosure or memory corruption. The vulnerability requires network access to the UpdateHub server component and has a low severity impact (CVSS 3.7).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix zeroes the metadata_copy buffer before copying to ensure proper NUL termination and prevent out-of-bounds reads. Until an official patch is available, consider restricting network access to the UpdateHub server or enabling optional security features such as CONFIG_UPDATEHUB_DTLS to prevent on-path attackers from manipulating the probe payload.
CVE-2026-11809: memory-safety in zephyrproject zephyr
Description
The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.
CVSS v3.1
Score 3.7low
Affected software
zephyrproject
zephyr
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The UpdateHub OTA client in Zephyr's subsys/mgmt/updatehub/updatehub.c has a memory safety issue in z_impl_updatehub_probe(). When the probe response from the UpdateHub server is copied into a heap buffer (metadata) and then into a second uninitialized buffer (metadata_copy) without zeroing, the strlen() call on metadata_copy can read past the allocated buffer if no terminating NUL byte is found. This leads to an out-of-bounds read of uninitialized heap memory. The probe payload is attacker-controlled, allowing a crafted payload to trigger this condition. The impact is a network-triggerable denial of service via a crash of the update thread or device. The vulnerability does not cause information disclosure or memory corruption. The fix involves zeroing metadata_copy before copying to ensure proper NUL termination and bounded strlen().
Potential Impact
An attacker controlling or intercepting the UpdateHub server response can cause the UpdateHub client to read uninitialized heap memory beyond the allocated buffer, potentially causing a crash of the update thread or the entire device. This results in a denial of service condition. There is no direct information disclosure or memory corruption. The vulnerability requires network access to the UpdateHub server component and has a low severity impact (CVSS 3.7).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix zeroes the metadata_copy buffer before copying to ensure proper NUL termination and prevent out-of-bounds reads. Until an official patch is available, consider restricting network access to the UpdateHub server or enabling optional security features such as CONFIG_UPDATEHUB_DTLS to prevent on-path attackers from manipulating the probe payload.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-09T15:51:47.489Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7a3b13bf8831d5398565e1
Added to database: 08/10/2026, 20:56:51 UTC
Last enriched: 08/10/2026, 21:30:31 UTC
Last updated: 09/25/2026, 01:47:40 UTC
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.