The vulnerability exists in the NVS backend of the Zephyr settings subsystem where stored setting-name entries are read into fixed 74-byte stack buffers. The function nvs_read() returns the full stored entry length, which can exceed the buffer size. The code uses this length directly as the index to NUL-terminate the buffer without clamping, causing a single out-of-bounds write of a NUL byte past the buffer boundary. This requires an attacker capable of writing to the flash device backing the settings partition, such as a co-resident or untrusted component, malicious image restore, or physical flash access. The out-of-bounds write can cause a crash or denial of service but does not allow code execution or confidentiality breaches. The vulnerability is triggered during settings_load() at boot or subsystem initialization, or during settings_save(). The fix involves skipping entries whose length exceeds the buffer size before writing the NUL byte, but no official patch is currently confirmed.

The vulnerability can cause a denial of service or crash due to a single out-of-bounds NUL byte write on the stack, resulting in limited stack corruption. There is no impact on confidentiality or integrity beyond limited corruption, and the vulnerability cannot be exploited remotely through the normal settings API. Exploitation requires write access to the flash device backing the settings partition, which is a high-barrier threat model involving co-resident components or physical access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves skipping any entry whose length returned by nvs_read() is greater than or equal to the buffer size before performing the NUL termination. Until an official patch is available, restrict or monitor access to the flash device backing the settings partition to prevent unauthorized writes.