Zephyr RTOS CVE-2026-10665

Requires the Zephyr WireGuard subsystem to be enabled and an established session so the attacker possesses a valid receiver session index; a valid Poly1305 authenticator is NOT required because the overflow occurs before authentication, so a malicious/compromised peer or an on-path attacker driving that session suffices. The out-of-bounds write only occurs when the inbound data_len exceeds CONFIG_WIREGUARD_BUF_LEN, which arises specifically when CONFIG_WIREGUARD_BUF_LEN is lowered below the link MTU, on links whose MTU is larger than the buffer size, or via reassembled IPv4/IPv6 fragments that together exceed the buffer. Limiting factors: this is not exploitable against a default configuration where the buffer is sized to the MTU and fragment reassembly does not produce oversized payloads, the WireGuard subsystem must be compiled in and configured, and the attacker must already hold a session index - all of which underlie the AC:H rating despite PR:N.

The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.4) is internally consistent with the description: network reachable and unauthenticated (PR:N, since only a session index is needed pre-authentication), but high complexity (AC:H) because the overflow only triggers under specific size conditions - CONFIG_WIREGUARD_BUF_LEN configured below the link MTU, links whose MTU exceeds the buffer, or reassembled IP fragments that exceed it. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-probability and automatability signals are absent rather than low; this should be read as 'unknown', not 'benign'. The realistic, confirmed impact is memory corruption leading to reliable DoS on an embedded device; the tags and description leave open the possibility of more than DoS, but code execution is not demonstrated. Net: a genuine, patch-worthy remote memory-corruption bug whose real-world priority is tempered by the non-default size preconditions and the requirement that the WireGuard subsystem be enabled with an established session - verify your CONFIG_WIREGUARD_BUF_LEN versus link MTU to gauge exposure.

A compromised or malicious WireGuard peer that shares an established session with a Zephyr device (or an on-path attacker able to inject into that session) sends a crafted transport-data UDP datagram whose length exceeds CONFIG_WIREGUARD_BUF_LEN. Because the vulnerable memcpy runs before the Poly1305 tag is verified, the attacker needs only a valid receiver session index - not a valid authenticator - to overflow the pool buffer and crash or corrupt the device. No public POC is identified at time of analysis, and the high attack complexity means the datagram must satisfy the specific size/fragmentation preconditions.