The vulnerability in Zephyr's PTP receive handler (ptp_msg_post_recv) involves using a 4-bit message type from incoming network packets to index a msg_size[] array without upper-bound checks. The array defines entries only up to message type 0xD, but types 0xE and 0xF cause out-of-bounds reads. This leads to further out-of-bounds reads and writes during message processing, reachable directly from the network via unauthenticated UDP multicast or raw Ethernet frames. The impact is primarily denial of service via crash, with a limited memory corruption possibility dependent on build specifics. The fix adds a check to reject message types greater or equal to the array size, preventing out-of-bounds access.

An attacker on the same network link can send crafted PTP packets with out-of-range message types to cause a denial of service by crashing the affected Zephyr node. There is also a limited memory corruption risk, but it depends on adjacent memory layout and cannot be reliably exploited. The vulnerability does not affect confidentiality or integrity but impacts availability.

A fix is available that rejects out-of-range message types before indexing the msg_size array, preventing out-of-bounds access. Users should upgrade to Zephyr version 4.4.2 or later where this issue is resolved.