Zephyr RTOS CVE-2026-10643

Out-of-bounds heap write in Zephyr RTOS (v3.6.0 through v4.4.0) occurs in the IP socket recvmsg() ancillary-data path when insert_pktinfo() validates the user's msg_control buffer against only the payload length and omits the aligned cmsg header, letting an undersized buffer pass the guard and take a fixed ~12-byte overwrite past its end. On builds with CONFIG_USERSPACE the recvmsg verifier stages the control buffer in a kernel-heap copy sized to msg_controllen, so an unprivileged userspace thread can corrupt kernel heap memory; in supervisor mode the caller's own buffer is corrupted. No public exploit identified at time of analysis, EPSS is low (0.12%, 2nd percentile), and CISA SSVC records no observed exploitation.

Out-of-bounds kernel-heap write in Zephyr RTOS (v3.6.0-v4.4.0) occurs when its IP socket recvmsg() implementation copies ancillary control data into an undersized msg_control buffer, letting a local unprivileged userspace thread (under CONFIG_USERSPACE) corrupt kernel heap memory. The flaw stems from insert_pktinfo() validating only the payload length and omitting the cmsg header size, so a control buffer in the 16-27 byte window for IPv4 IP_PKTINFO on a 64-bit target passes the guard yet triggers a fixed ~12-byte overflow. There is no public exploit identified at time of analysis, EPSS is low (0.12%), and CISA SSVC rates exploitation as none; real-world risk is bounded by the need for local code execution plus a specific application usage pattern.

Out-of-bounds heap write in Zephyr RTOS (v3.6.0 through v4.4.0) lets an unprivileged local thread corrupt kernel memory through the IP socket recvmsg() path. The insert_pktinfo() routine sized its control-buffer capacity check against only the ancillary payload length while later writing an aligned cmsg header plus payload, so an undersized msg_control buffer passes validation and triggers a fixed ~12-byte overflow past the buffer end. Under CONFIG_USERSPACE the overflow lands in a kernel-heap copy, making it reachable across the user/kernel boundary; there is no public exploit identified at time of analysis and EPSS is low (0.12%).

Out-of-bounds heap write in the Zephyr RTOS IP socket stack (v3.6.0 through v4.4.0) lets a local unprivileged userspace thread corrupt kernel memory when receiving datagrams via recvmsg(). The insert_pktinfo() routine sized its control-buffer capacity check on the payload length alone, omitting the aligned cmsg header, so an undersized ancillary buffer passes validation and triggers a fixed ~12-byte overflow. No public exploit is identified at time of analysis and EPSS is low (0.12%), but the flaw is a genuine memory-corruption primitive reachable from unprivileged code under CONFIG_USERSPACE.

Out-of-bounds heap write in Zephyr RTOS (v3.6.0 through v4.4.0) lets an unprivileged userspace thread corrupt kernel memory by calling recvmsg() with an undersized ancillary (msg_control) buffer on a UDP/IP socket that has IP_PKTINFO, IPV6_RECVPKTINFO, hoplimit, or timestamping enabled. The insert_pktinfo() capacity check compared the buffer length against only the payload length and omitted the aligned cmsg header, so a control buffer in the under-checked window (e.g. 16-27 bytes for IPv4 IP_PKTINFO on a 64-bit target) passes validation yet triggers a fixed-size write of up to ~12 header bytes past the buffer end. There is no public exploit identified at time of analysis; EPSS is low (0.12%, 2nd percentile) and the flaw is not in CISA KEV.