The vulnerability in Zephyr's settings subsystem (subsys/settings/src/settings_nvs.c) arises from improper handling of stored setting-name entries read into a fixed 74-byte stack buffer. The nvs_read() function returns the full stored entry length, which can be larger than the buffer size, but this length is used directly as the index to write a terminating NUL byte, causing a single-byte out-of-bounds write on the stack. This can only be triggered by an attacker capable of writing to the flash memory backing the settings partition, such as through a malicious image or physical access. The out-of-bounds write leads to limited stack corruption and potential denial of service or crash but does not allow code execution or confidentiality breaches. The vulnerability is present in Zephyr versions >=2.0.0 and <4.5.0. The patch skips entries with lengths exceeding the buffer size to prevent the out-of-bounds write.

An attacker with the ability to write to the flash memory backing the settings partition can cause a single-byte out-of-bounds write on the stack during settings load or save operations. This can lead to denial of service or system crash due to stack corruption. There is no impact on confidentiality or integrity beyond limited stack corruption, and the vulnerability cannot be exploited remotely through the normal settings API.

A fix is available that prevents the out-of-bounds write by skipping any stored setting-name entry whose length returned by nvs_read() is greater than or equal to the buffer size before writing the terminating NUL byte. Users should upgrade to Zephyr version 4.5.0 or later where this fix is included. Until then, ensure that only trusted components have write access to the flash backing the settings partition to mitigate exploitation risk.