Threat database

Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose payload was exactly 16 bytes (an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive) was accepted and returned immediately, before wg_decrypt_packet() was ever called. The Poly1305 authentication tag was therefore never verified; the only preceding gates were a cleartext receiver-index lookup (get_peer_keypair_for_index() on the attacker-supplied data_hdr->receiver) and a non-cryptographic keypair validity/expiry check. The path is reachable entirely from the network: inbound UDP on the WireGuard port is dispatched by wg_input() to handle_transport_data() and then wg_process_data_message(). The 32-bit receiver index is transmitted in cleartext in WireGuard handshake and data messages, so an on-path observer learns it directly and an off-path attacker can brute-force it against the UDP port. Given an active receiving-valid session for that index, an attacker could send a 16-byte garbage payload and have it accepted without possessing the session key. On acceptance the unauthenticated message caused the management layer to observe a spoofed NET_EVENT_VPN_CONNECTED signal (setting peer->first_valid and notifying any net_mgmt listener) and incremented the keepalive-RX statistic. The impact is limited to integrity of this status signal: no plaintext is decrypted or injected, no key is disclosed, and the early-return path did not update the peer endpoint or liveness timers, so there is no traffic-injection, session-takeover, or availability consequence. The fix removes the pre-decrypt early return so a 16-byte payload flows through wg_decrypt_packet(), which verifies the Poly1305 tag over the empty plaintext, followed by the existing anti-replay check; only an authenticated, non-replayed message is then recognised as a keepalive. Forged keepalives now fail the tag check and are counted as decrypt failures.

Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE_TRANSPORT_DATA packet succeeded, the code committed several peer-state changes — update_peer_addr() (endpoint roaming update), the keypair->last_rx/peer->last_rx liveness timers, and keypair_update() (promote next→current and destroy the previous keypair) — and only afterward called wg_check_replay(). On a replayed packet the replay check returned -EINVAL, but none of the preceding mutations were rolled back. The AEAD tag authenticates content but not freshness, so a replayed-but-authentic transport packet decrypts correctly. An attacker who captures one valid ciphertext off the wire (an on-path or shared-medium observer) can re-inject it from an arbitrary spoofed source address. Reaching the handler requires no credentials: it is driven directly from inbound UDP datagrams via the dispatch in subsys/net/lib/wireguard/wg.c. Because the state mutations committed before the replay check, the replay repoints the peer endpoint to the attacker-chosen source address (roaming hijack), redirecting the victim's subsequent outbound tunnel traffic until the legitimate peer's next packet re-corrects it; it also prematurely destroys the previous keypair and refreshes the RX liveness timer. The tunnel payload stays encrypted under the session keypair, so this is an integrity/availability impact (traffic redirection and session disruption), not payload disclosure. The fix moves wg_check_replay() to immediately after a successful decrypt, before any peer-state mutation, matching the WireGuard specification and the Linux reference implementation.

CVE-2026-13481 is a medium severity vulnerability in the Zephyr project's IEEE 1588 PTP management-message parser. The flaw occurs because the parser mishandles the PTP_MGMT_TIME management ID by not validating the length of the TLV data before casting and accessing it. This can lead to an out-of-bounds read and a bounded in-place corruption of the parsed timestamp within the message buffer. The vulnerability allows an adjacent attacker on the local PTP segment to send a specially crafted message causing minor information exposure and corruption of the device's parsed management TIME value without causing crashes or broader memory corruption. A fix involves adding a length check before processing the timestamp data.

CVE-2026-13480 is a low-severity vulnerability in the Zephyr project's LoRaWAN TS004 Fragmented Data Block Transport handler. It involves an out-of-bounds read due to insufficient validation of payload length before accessing data structures during downlink command parsing. The flaw requires possession of the device's session keys and results in limited confidentiality impact without enabling code execution or memory corruption.

CVE-2026-13479 is a low-severity vulnerability in the Zephyr project's LoRaWAN clock-synchronization service. The vulnerability arises from insufficient bounds checking when parsing the AppTimeAns command in downlink messages, allowing a read of up to 5 bytes beyond the decrypted payload buffer. This over-read does not cause crashes or data disclosure but can cause a minor integrity impact by applying a garbage time correction to the device's clock offset. Exploitation requires a malicious or compromised network/application server or possession of session keys. A fix involves adding an explicit length check to drop too-short AppTimeAns messages.

CVE-2026-13478 is a medium severity vulnerability in the Zephyr ext2 filesystem driver that causes an out-of-bounds read during mounting of a crafted ext2 image. The flaw arises from improper bounds checking of the block bitmap size, allowing a large memory read beyond the allocated bitmap buffer. This leads to a denial of service by crashing the system when mounting attacker-controlled ext2 media. No information leak or code execution is possible. A fix is available that rejects images with oversized block counts before scanning.

CVE-2026-13217 is a memory-safety vulnerability in the Zephyr project's OCPP 1.6 client. It involves improper handling of server-supplied uid strings in the ocpp_process_server_msg() function, leading to a NULL pointer dereference when parsing malformed uid values. This can cause a remote denial of service on platforms that trap NULL pointer accesses. The vulnerability is triggered by network data from a malicious or compromised OCPP central system or a man-in-the-middle on non-TLS connections. The fix partially addresses the issue but does not fully guard against all NULL dereferences in the parsing logic.

CVE-2026-13216 is a vulnerability in the Zephyr project's virtio PCI driver where an unvalidated device-supplied capability length can cause out-of-bounds stack writes during device initialization. This occurs because a length value read from the PCI config space is only checked by an assert that is disabled in production builds, allowing attacker-controlled data to overflow a fixed-size buffer. The flaw can lead to kernel stack corruption and potential code execution or crashes when an untrusted virtio PCIe device is present. The vulnerability primarily affects bare-metal systems with untrusted devices or confidential computing scenarios where the guest must defend against the host. A fix replaces the disabled assert with a runtime range check to validate the length before copying data.

CVE-2026-13215 is a vulnerability in the Zephyr ext2 filesystem driver where the s_log_block_size field from the on-disk superblock is not properly validated during filesystem mount. This allows an attacker to supply a crafted ext2 image with a manipulated s_log_block_size value that can cause an out-of-bounds write in kernel memory. The flaw arises because the driver calculates a block size based on this unchecked field and uses it to initialize memory slabs without verifying buffer boundaries. This can lead to memory corruption with impacts ranging from denial of service to potential code execution in kernel mode.

CVE-2026-13214 is a critical stack buffer overflow vulnerability in the Zephyr project's OCPP 1.6 client. The flaw occurs in the parse_getconfig_msg() function when handling a GetConfiguration request, where an attacker-controlled JSON key string is copied without bounds into a fixed 50-byte stack buffer. This allows an attacker controlling the central system endpoint or a man-in-the-middle on an unencrypted connection to overflow the stack, potentially causing denial of service or remote code execution depending on system hardening.

The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed() runs for every connection that establishes security even before the application has called bt_has_register(). The service attribute pointers hearing_aid_features_attr, preset_control_point_attr, and active_preset_index_attr remain NULL until bt_has_register() resolves them and sets has.registered. With CONFIG_BT_SETTINGS, settings_set_cb() restores each bonded client's persisted context at boot and unconditionally sets context->flags to BONDED_CLIENT_INIT_FLAGS (non-zero). When a previously bonded peer reconnects and re-establishes security during the startup window before bt_has_register() has been called, security_changed() sees the non-zero flags and schedules notify_work_handler, which calls bt_gatt_is_subscribed() with a still-NULL attribute pointer. That triggers an assertion (__ASSERT(attr, ...) in bt_gatt_is_subscribed()), or a NULL dereference of attr->uuid when assertions are compiled out. The result is a remotely triggerable (Bluetooth, adjacent) crash of the HAS peripheral. Exploitation requires the peer to have previously bonded with the device and to reconnect within the boot-time race window before the application registers the service; a peer that reconnects persistently can prolong the outage. Impact is denial of service only, with no memory corruption or information disclosure. The fix adds an early if (!has.registered) { return; } guard in security_changed(), so no notification work is scheduled until the GATT service is registered and its attribute pointers are valid.

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c), the device-written vq->used->ring[idx].id is used directly as an index into vq->recv_cbs[] and vq->desc[], which are both allocated with exactly vq->num entries. recv_cbs[] holds {cb, opaque} callback entries, and the indexed callback pointer is then invoked as cbe.cb(cbe.opaque, used_len). Because the id is consumed as a 16-bit value with no bound check, a malicious or compromised virtio backend (an untrusted hypervisor, or an untrusted hardware/peer-processor virtio device on a PCI or MMIO transport) can supply an id far beyond vq->num. This causes an out-of-bounds read of a {function pointer, argument} pair from heap memory beyond recv_cbs[], after which the driver calls that attacker-shaped pointer in the guest's interrupt context. No guest privileges or user interaction are required; the backend triggers it by writing the shared used ring and raising the queue interrupt. The result is an arbitrary / attacker-influenced function-pointer call in the Zephyr guest, i.e. a control-flow-hijack primitive that can lead to code execution or, at minimum, a reliable crash. The fix rejects any used-ring id >= vq->num before indexing recv_cbs[]/desc[] or invoking the callback. This affects builds using CONFIG_VIRTIO with the PCI or MMIO transport.

The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents. Endpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts. Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact. The fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed.

CVE-2026-9728 is a race condition vulnerability in the Zephyr project's userspace syscall verifier for the mbox_send() system call. The flaw allows a time-of-check/time-of-use (TOCTOU) race where a malicious userspace thread can replace a pointer after validation but before use, causing the kernel to read from an attacker-controlled supervisor address. This can lead to disclosure of kernel memory or denial of service due to a faulting kernel read. The vulnerability affects Zephyr version 3.0.0 and requires userspace support (CONFIG_USERSPACE).

CVE-2026-12999 is a denial-of-service vulnerability in the Infineon Airoc Wi-Fi driver within the Zephyr project. The vulnerability causes a permanent memory leak of network buffers on transmit failures, eventually exhausting the buffer pool and causing loss of Wi-Fi connectivity until the device is rebooted. The issue arises from failure to release allocated buffers on synchronous send errors. The vulnerability affects Zephyr versions from 3.6.0 up to but not including 4.4.2. The impact is availability-only, with no confidentiality or integrity effects. Exploitation requires complex conditions and is not known to be exploited in the wild. A fix has been implemented to properly release buffers on failure.

CVE-2026-12634 is a medium-severity vulnerability in the Zephyr project's settings subsystem. It involves an out-of-bounds write of a single NUL byte past a fixed 74-byte stack buffer when reading stored setting-name entries from flash memory. This occurs because the nvs_read() function returns the full stored entry length, which can exceed the buffer size, and this length is used directly as the NUL terminator index without proper bounds checking. Exploitation requires an attacker with the ability to write directly to the flash backing the settings partition, such as a co-resident or untrusted component or physical access. The impact is limited to denial of service or crash due to stack corruption; there is no confidentiality impact and no network exposure via the normal settings API. The vulnerability affects Zephyr versions from 2.0.0 up to but not including 4.5.0. The fix involves skipping entries whose length exceeds the buffer size before writing the NUL terminator.

CVE-2026-12522 is a high-severity vulnerability in the Zephyr project's HL7800 cellular modem driver. It involves a stack-based buffer overflow caused by improper bounds checking when parsing the +CGCONTRDP response from the cellular network. The vulnerability allows a malicious or rogue cellular network to send an overlong address field, leading to out-of-bounds writes on the stack. This can cause a crash or potentially enable control-flow hijacking without requiring device privileges or user interaction. The issue affects Zephyr versions from 2.4.0 up to but not including 4.4.2. A fix has been implemented to properly bound field lengths before copying data.

CVE-2026-12633 is a memory safety vulnerability in the Zephyr project's IPv6 neighbor-discovery code. It arises from improper bounds checking of the 6LoWPAN Context Option (6CO) context_len field in Router Advertisements, leading to an out-of-bounds memset that overwrites kernel memory. This flaw can be triggered remotely by an unauthenticated attacker on the same local network segment, causing a denial of service through memory corruption. The vulnerability affects Zephyr versions from 1.8.0 up to but not including 4.4.2. A fix is available that rejects context_len values greater than 128 before processing.

CVE-2026-12632 is a vulnerability in Zephyr's Precision Time Protocol (PTP) receive handler where an out-of-bounds read occurs due to improper indexing of a message size table. This flaw allows an attacker on the same network link to cause a denial of service by triggering a crash. The vulnerability arises because the message type extracted from network packets is not properly bounded before indexing an array, leading to memory corruption risks. The issue affects Zephyr versions from 3.7.0 up to but not including 4.4.2. A fix is available that rejects out-of-range message types before indexing.

CVE-2026-12631 is a vulnerability in the Zephyr kernel affecting the k_thread_join() and k_thread_abort() system calls. The kernel incorrectly handles access denial errors during thread object validation, leading to either a kernel crash or an access-control bypass depending on the compiler used. This flaw allows an unprivileged user-mode thread to cause a denial of service or potentially bypass access controls. The issue affects Zephyr versions from 2.3.0 up to but not including 4.4.2. A fix is available that corrects the verification logic to properly terminate unauthorized callers.