2026-03-14

CVE-2026-0849 Mar 14, 21:05 LOW Monitor

Stack buffer overflow in the Zephyr RTOS ATAES132A crypto driver allows a physically-present or bus-positioned attacker to overflow a fixed 52-byte stack buffer by supplying malformed device responses with an oversized length field. Affected systems run Zephyr versions up to and including 4.3 with the ATAES132A driver enabled, and successful exploitation can corrupt kernel stack memory with potential for execution hijack. No public exploit has been identified and the EPSS score of 0.01% (3rd percentile) reflects the highly constrained physical access prerequisite; the vulnerability is not listed in CISA KEV.