EUVD-2026-43699Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Network vector, but exploitation needs an authorized LwM2M server session (or weak-DTLS on-path), so PR:L; over-read yields high confidentiality/availability impact and no integrity change.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM2M management server (or an on-path attacker on a session lacking strong DTLS) can WRITE a URI of 128-254 characters; only the first 128 bytes are then copied into context.uri with no NUL terminator. That buffer is subsequently consumed as a C string by http_parser_parse_url(context.uri, strlen(context.uri), ...), strlen-based CoAP URI-path/PROXY-URI option appends, and lwm2m_parse_peerinfo(), causing an out-of-bounds read of adjacent static memory. The over-read bytes are appended to outbound CoAP requests (information disclosure of adjacent device memory to the server/proxy) and can crash the device (denial of service). The vulnerable copy was introduced by the pull-context refactor (first released in v3.0.0) and is present through v4.4.0; the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected. The fix adds a strlen(uri) >= sizeof(context.uri) check returning -ENOMEM and switches to strcpy(), guaranteeing a bounded, NUL-terminated buffer.
AnalysisAI
Out-of-bounds read in the Zephyr RTOS LwM2M firmware-update pull client (lwm2m_pull_context.c) lets a malicious or compromised LwM2M management server - or an on-path attacker on a session without strong DTLS - leak adjacent device memory and crash devices by writing an over-long firmware Package URI (/5/0/1). Because the Firmware-Update object stores the URI in a 255-byte buffer but the pull context copies exactly 128 bytes into a fixed buffer with no NUL terminator, subsequent strlen-based parsing over-reads static memory that is then appended to outbound CoAP requests. It affects Zephyr 3.0.0 through 4.4.0 on the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path; there is no CISA KEV listing, EPSS is low (0.28%), and per the SSVC framework a proof-of-concept exists.
Technical ContextAI
The affected component is Zephyr's Lightweight M2M (LwM2M) implementation, a UDP/CoAP-based device-management protocol (OMA LwM2M) commonly secured with DTLS. The firmware-update 'pull' mechanism (object /5, Firmware Update; resource /5/0/1, Package URI) downloads firmware from a URI the management server writes into the device. The root cause is CWE-125 (out-of-bounds read) arising from an unterminated string: subsys/net/lib/lwm2m/lwm2m_pull_context.c performed memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size (CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with no length check and no NUL termination, even though the source Package URI buffer holds up to 255 bytes. The truncated, non-terminated buffer is then treated as a C string by http_parser_parse_url(context.uri, strlen(context.uri), ...), by strlen-based CoAP URI-Path/Proxy-URI option appends, and by lwm2m_parse_peerinfo(), so parsing runs past the 128-byte buffer into adjacent static memory. The over-read bytes are copied into outbound CoAP requests to the server/proxy (information disclosure) and can fault the device (denial of service). The bug was introduced by the pull-context refactor first released in v3.0.0; the CPE cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:* confirms the Zephyr project as the affected product.
RemediationAI
Vendor-released patch: Zephyr 4.5.0 - upgrade affected devices from any 3.0.0-4.4.0 build to 4.5.0 or later, or backport commit 99a164df5cea5af76e32b57c6d51854f018969a2, which adds a strlen(uri) >= sizeof(context.uri) guard returning -ENOMEM and replaces memcpy with strcpy to guarantee a bounded, NUL-terminated buffer. If you cannot rebuild firmware immediately, the most direct compensating control is to disable the firmware pull path by unsetting CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT (trade-off: over-the-air pull-style FOTA via LwM2M is lost, so plan an alternative update mechanism); alternatively enforce strong, mutually-authenticated DTLS on all LwM2M sessions and restrict which management servers may write resource /5/0/1, which closes the on-path/rogue-server vector without removing FOTA but does not protect against an already-trusted-but-compromised server. Where feasible, also constrain or validate Package URI length before it reaches the device. Full details are in advisory GHSA-rf6j-4mpp-j9mf (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf).
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today