Remote out-of-bounds read in Zephyr LwM2M firmware pull URI handling (CVE-2026-10672)

A remote out-of-bounds read exists in Zephyr RTOS's LwM2M firmware pull implementation. A server-controlled Package URI is copied via fixed-length memcpy() into a smaller pull-context buffer without a NUL terminator, causing subsequent strlen() calls to read beyond the buffer boundary. This allows a remote LwM2M server to cause denial of service and, in proxy-enabled configurations, information disclosure of adjacent device memory via outgoing CoAP options. Affected versions: - v4.3.0 - v4.2.1 - v3.7.1 We recommend updating to: v4.5.0. CVSS 9.1 · our assessment: act_now Reference: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf Details: https://vuln.today/cve/CVE-2026-10672