CVE-2026-18418: bounds in zephyrproject zephyr

The vulnerability exists in the zbus proxy agent IPC backend of Zephyr (subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c). When a rejected inter-domain frame contains a channel_name array that is not null-terminated, the logging code uses a plain %s conversion, causing strlen() to read beyond the buffer boundary. This can leak adjacent stack or shared memory contents into logs or cause a fatal fault if the read crosses unmapped memory. The flaw is triggered by a peer domain able to send crafted frames with out-of-range message sizes or non-null-terminated channel_name arrays. The vulnerability requires CONFIG_ZBUS_PROXY_AGENT_IPC enabled and logging at warning level or above. The fix involves bounding the string conversion with %.*s and limiting the length to the smaller of the channel_name length or buffer size.

An attacker with control over a peer domain's firmware on the same SoC can cause out-of-bounds reads during logging, potentially disclosing a small amount of adjacent memory from the IPC work-queue thread's stack or shared vring memory. This leads to limited information disclosure. There is also a risk of a fatal fault if the read crosses into unmapped memory regions. The vulnerability does not allow code execution or data modification. The CVSS score is 3.4 (low severity), reflecting limited confidentiality impact and no integrity impact.

A fix is available in Zephyr versions 4.4.2 and later that bounds the string conversion to prevent out-of-bounds reads. Users should upgrade to version 4.4.2 or later to remediate this issue. The vulnerability requires CONFIG_ZBUS_PROXY_AGENT_IPC enabled and logging at warning level or above, so disabling this configuration or lowering logging level may reduce exposure but is not a substitute for patching.