CVE-2026-12522: bounds in zephyrproject zephyr

The HL7800 cellular modem driver's response handler for the +CGCONTRDP AT command in Zephyr improperly handles parsing of PDP-context dynamic parameters. It linearizes the network response into a 256-byte stack buffer, then extracts address fields using delimiter positions controlled by the network. These lengths are used directly in strncpy() calls to fixed-size stack buffers (64 bytes for temp_addr_str and 16 bytes for dns_v4_string) without bounds checking. This allows a malicious cellular network to craft a response with an overlong field, causing a stack buffer overflow and an out-of-bounds null byte write. The overflow occurs on the modem worker thread stack in supervisor context, enabling at minimum a remote crash and potentially control-flow hijacking on systems lacking stack protection. The vulnerability requires no device privileges or user interaction as the device issues the AT command during normal network attach. The fix adds bounds checks on field lengths before copying, rejecting overlong fields.

A remote attacker controlling or impersonating a cellular network can trigger a stack buffer overflow on the device by sending a crafted +CGCONTRDP response. This can cause a denial of service via a crash or potentially allow remote code execution through control-flow hijacking on vulnerable devices without stack protection. No user interaction or device privileges are needed, making exploitation feasible during normal network attach procedures.

A fix is available that bounds every field length against its destination buffer before copying, rejecting overlong fields. Users should upgrade to Zephyr version 4.4.2 or later where this vulnerability is patched. There are no vendor advisories indicating alternative mitigations or that the issue is already mitigated.