The vulnerability exists in the Zephyr RTOS network sockets subsystem, specifically in the TLS socket connect path (subsys/net/lib/sockets/sockets_tls.c). When TLS session caching is enabled, the functions tls_session_store() and tls_session_restore() use memcpy to copy data from a caller-supplied address into a fixed-size buffer. The length parameter (addrlen) is controlled by the caller but is not validated against the destination buffer size. Because struct net_sockaddr is opaque and smaller than possible addrlen values, an attacker can supply an addrlen larger than the buffer size (e.g., 128 bytes into a 24-byte buffer), causing out-of-bounds memory access. This can lead to memory corruption, crashes, denial of service, and potentially arbitrary code execution.

The vulnerability allows an attacker with local privileges (low complexity, no user interaction) to cause out-of-bounds memory writes and reads in the TLS session cache. This can result in denial of service through crashes and may enable arbitrary code execution. Confidentiality and integrity impacts are limited but present due to potential memory corruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling TLS session caching if feasible or restrict access to the affected TLS socket connect functionality to trusted users. Monitor vendor channels for updates and apply patches promptly once released.