CVE-2026-12630: bounds in zephyrproject zephyr
Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC dispatch word (iphc & NET_6LO_IPHC_DA_MASK, a 4-bit value of 0-15). The reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table. The iphc word is taken directly from the received frame, and get_ihpc_inlined_size() is reached on every inbound 6LoWPAN frame via net_6lo_uncompress() from the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee802154_6lo.c and ieee802154_6lo_fragment.c). An unauthenticated attacker on the radio/adjacent link can therefore craft a frame whose destination addressing-mode nibble selects an out-of-range index, with no privileges or user interaction. The out-of-bounds value becomes the computed inline_size, which then drives header reconstruction before the buffer-length check: it is used to dereference *(pkt->buffer->data + sizeof(iphc) + inline_size) and to compute a size_t diff that can underflow, leading to a further out-of-bounds read of the packet buffer and malformed uncompression. The practical impact is a radio-triggerable out-of-bounds read / denial-of-service on the receiver; the leaked byte is not returned to the attacker. The fix rejects any destination index beyond the table, aborting processing of the malformed frame.
AI Analysis
Technical Summary
The vulnerability exists in the get_ihpc_inlined_size() function within Zephyr's 6LoWPAN IP Header Compression uncompression code (subsys/net/ip/6lo.c). The function uses an index derived from bits in the received IPHC dispatch word to access da_inline_size_table, which has 13 entries. However, the index can be a 4-bit value ranging from 0 to 15, and the reserved values 13, 14, and 15 are not bounds-checked, causing out-of-bounds reads. This index is derived directly from untrusted received frames on the 802.15.4 radio link. The out-of-bounds read leads to malformed header reconstruction and can cause a denial-of-service by crashing or destabilizing the receiver. The vulnerability requires no privileges or user interaction and is triggered by crafted radio frames. The fix involves rejecting any destination index beyond the table size and aborting processing of malformed frames. No patch or official fix status is provided in the available data.
Potential Impact
An unauthenticated attacker within radio range can send specially crafted 6LoWPAN frames that cause out-of-bounds reads in the IPHC uncompression code, leading to denial-of-service on the affected device. There is no confidentiality or integrity impact, and no data is leaked to the attacker. The impact is limited to availability disruption of the receiver processing the malformed frames.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects out-of-range destination indexes and aborts processing of malformed frames, preventing the vulnerability. Until an official patch is available, consider filtering or blocking suspicious 6LoWPAN frames at the network edge if possible.
CVE-2026-12630: bounds in zephyrproject zephyr
Description
Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC dispatch word (iphc & NET_6LO_IPHC_DA_MASK, a 4-bit value of 0-15). The reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table. The iphc word is taken directly from the received frame, and get_ihpc_inlined_size() is reached on every inbound 6LoWPAN frame via net_6lo_uncompress() from the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee802154_6lo.c and ieee802154_6lo_fragment.c). An unauthenticated attacker on the radio/adjacent link can therefore craft a frame whose destination addressing-mode nibble selects an out-of-range index, with no privileges or user interaction. The out-of-bounds value becomes the computed inline_size, which then drives header reconstruction before the buffer-length check: it is used to dereference *(pkt->buffer->data + sizeof(iphc) + inline_size) and to compute a size_t diff that can underflow, leading to a further out-of-bounds read of the packet buffer and malformed uncompression. The practical impact is a radio-triggerable out-of-bounds read / denial-of-service on the receiver; the leaked byte is not returned to the attacker. The fix rejects any destination index beyond the table, aborting processing of the malformed frame.
CVSS v3.1
Score 4.3medium
Affected software
zephyrproject
zephyr
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the get_ihpc_inlined_size() function within Zephyr's 6LoWPAN IP Header Compression uncompression code (subsys/net/ip/6lo.c). The function uses an index derived from bits in the received IPHC dispatch word to access da_inline_size_table, which has 13 entries. However, the index can be a 4-bit value ranging from 0 to 15, and the reserved values 13, 14, and 15 are not bounds-checked, causing out-of-bounds reads. This index is derived directly from untrusted received frames on the 802.15.4 radio link. The out-of-bounds read leads to malformed header reconstruction and can cause a denial-of-service by crashing or destabilizing the receiver. The vulnerability requires no privileges or user interaction and is triggered by crafted radio frames. The fix involves rejecting any destination index beyond the table size and aborting processing of malformed frames. No patch or official fix status is provided in the available data.
Potential Impact
An unauthenticated attacker within radio range can send specially crafted 6LoWPAN frames that cause out-of-bounds reads in the IPHC uncompression code, leading to denial-of-service on the affected device. There is no confidentiality or integrity impact, and no data is leaked to the attacker. The impact is limited to availability disruption of the receiver processing the malformed frames.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects out-of-range destination indexes and aborts processing of malformed frames, preventing the vulnerability. Until an official patch is available, consider filtering or blocking suspicious 6LoWPAN frames at the network edge if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-18T15:22:25.574Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a8339cebf8831d53935e2fe
Added to database: 08/17/2026, 16:41:50 UTC
Last enriched: 08/17/2026, 16:58:15 UTC
Last updated: 10/02/2026, 02:46:02 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.