The vulnerability exists in the CoAP link-format helper match_path_uri() function in Zephyr's subsys/net/lib/coap/coap_link_format.c. The function compares a registered resource path against a URI from a Uri-Query href= option that is not NUL terminated. The inner loop advances an index without checking against the option length, causing an over-read past the end of the URI buffer when the registered path segment is longer than the URI and the URI is a prefix. This over-read reads uninitialized stack memory but does not reach the receive buffer or influence response matching. The impact is limited to undefined behavior. The fix adds a boundary check to prevent reading beyond the option length.

The vulnerability results in a bounded out-of-bounds read of uninitialized stack memory, which leads to undefined behavior. It does not cause information disclosure, incorrect resource matching, or denial of service. The over-read is limited to approximately one byte and cannot influence the CoAP server response.

A fix is available that adds a boundary check to prevent out-of-bounds reads in match_path_uri(). Users should upgrade to Zephyr version 4.4.2 or later where this issue is resolved. No additional mitigation is required as the vulnerability does not lead to information disclosure or denial of service.