What is the CVSS score of CVE-2026-0849?

CVE-2026-0849 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Zephyr RTOS are affected by CVE-2026-0849?

CVE-2026-0849 is a low-severity vulnerability (CVSS 3.8). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

How to fix or mitigate CVE-2026-0849?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Zephyr RTOS CVE-2026-0849

EUVD-2026-12186 LOW

Classic Buffer Overflow (CWE-120)

2026-03-14 zephyr

Buffer Overflow Zephyr Zephyrproject Rtos

3.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.8 LOW

AV:P/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Physical bus access (AV:P) and high complexity (AC:H) are confirmed; kernel memory corruption with execution hijack potential justifies C:H/I:H/A:H over the vendor's conservative C:L/I:L/A:L.

3.1 AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:18 vuln.today

EUVD ID Assigned

Mar 14, 2026 - 22:00 euvd

EUVD-2026-12186

CVE Published

Mar 14, 2026 - 21:05 nvd

LOW 3.8

DescriptionCVE.org

Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.

AnalysisAI

Stack buffer overflow in the Zephyr RTOS ATAES132A crypto driver allows a physically-present or bus-positioned attacker to overflow a fixed 52-byte stack buffer by supplying malformed device responses with an oversized length field. Affected systems run Zephyr versions up to and including 4.3 with the ATAES132A driver enabled, and successful exploitation can corrupt kernel stack memory with potential for execution hijack. No public exploit has been identified and the EPSS score of 0.01% (3rd percentile) reflects the highly constrained physical access prerequisite; the vulnerability is not listed in CISA KEV.

Technical ContextAI

The Zephyr RTOS (cpe:2.3:a:zephyrproject-rtos:zephyr:*:*:*:*:*:*:*:*) includes a driver for the Microchip ATAES132A, an AES-128 hardware security co-processor that communicates over I2C or SPI. When the driver parses a response packet from the ATAES132A device, it reads the length field from the response and copies payload data into a fixed 52-byte buffer allocated on the kernel stack without first validating that the reported length fits within that buffer. This is a textbook CWE-120 (Classic Buffer Overflow) - the absence of a bounds check allows an attacker who controls the bus response to write past the 52-byte boundary, corrupting adjacent stack frames including saved return addresses and local variables in kernel context. The affected version range covers all Zephyr releases up to and including 4.3, as confirmed by EUVD-2026-12186.

RemediationAI

The primary remediation is to update Zephyr RTOS to a version that incorporates the upstream fix for GHSA-ff4p-3ggg-prp6, available via the Zephyr project advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-ff4p-3ggg-prp6. An exact patched release version is not independently confirmed from the available data - verify the minimum safe version against the upstream advisory before deploying. If immediate patching is not feasible, the most effective compensating control is to disable the ATAES132A driver at build time by removing CONFIG_CRYPTO_ATAES132A from the Zephyr build configuration; the trade-off is loss of ATAES132A hardware crypto acceleration, which must be replaced by an alternative crypto path if that functionality is required. Additionally, restricting physical access to the I2C or SPI bus on deployed hardware reduces the bus-attacker attack surface, as does supply-chain vetting to prevent compromised ATAES132A peripheral chips from entering the device fleet.