The vulnerability in Zephyr's MCUmgr SMP-over-console transport arises from improper handling of packet length in base64-decoded frames. Specifically, mcumgr_serial_process_frag() subtracts 2 from a 16-bit buffer length without validating that the length is sufficient, causing an underflow when the declared length is 0 or 1. This results in the SMP layer receiving a buffer length inflated to about 65 KB, far exceeding the actual buffer size (default 384 bytes). Consequently, smp_process_request_packet() reads out-of-bounds memory, which can cause a denial of service or leak memory contents via the OS echo handler. The vulnerability requires only write access to the management console and no authentication. The fix implemented rejects packet lengths of two bytes or fewer, eliminating the underflow condition. The test-only loopback transport retains the pattern but is not externally exposed.

An attacker with write access to the management console can trigger an out-of-bounds read by sending a crafted 7-byte frame, leading to denial of service via thread faults or potential memory disclosure through the OS echo handler. No authentication or prior session state is required. The impact is limited to confidentiality loss of memory contents and availability disruption. Integrity is not further compromised beyond the unauthenticated transport's existing limitations.

A fix is available that rejects any declared packet length of two bytes or fewer in mcumgr_serial_extract_len(), preventing the buffer length underflow. Users should upgrade to Zephyr version 4.4.2 or later where this patch is applied. No additional mitigation is required as the vulnerability is addressed by this official fix.