The vulnerability exists in parse_write_op() within subsys/net/lib/lwm2m/lwm2m_message_handling.c of Zephyr. When handling the first block of a block-wise CoAP transfer, the function calls init_block_ctx(), which may return -ENOMEM and set the context pointer to NULL if no free block context is available. However, the code immediately stores a value into the context pointer without verifying it is non-NULL, causing a NULL pointer dereference. An attacker can exploit this by initiating multiple incomplete block-wise writes to exhaust the block context pool and then trigger the dereference with a fourth write. The impact is a fatal memory fault (BusFault or corrupted low memory), causing device crashes or resets. The vulnerability does not compromise confidentiality or integrity. The fix involves validating the context pointer before use and moving the store operation below the guard. The affected versions are Zephyr >=3.7.0 and <4.5.0.

Successful exploitation leads to a denial of service via device crash or reset due to a fatal memory fault caused by NULL pointer dereference. Confidentiality and integrity are not impacted. The vulnerability can be triggered by an unauthenticated attacker in NoSec deployments or by legitimate servers running multiple concurrent block transfers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described involves validating the block context pointer before use to prevent NULL dereference. Until a patch is applied, limiting the number of concurrent block-wise transfers or enabling DTLS support (CONFIG_LWM2M_DTLS_SUPPORT) may reduce exposure, but no official mitigation is confirmed in the provided data.