Zephyr RTOS CVE-2026-12634

Exploitation has one hard prerequisite: the attacker must have write access to the raw NVS flash partition backing the Zephyr settings subsystem. The three concrete paths to meeting that condition are: (1) a co-resident RTOS task or firmware component that shares access to the same flash device without partition isolation; (2) delivery of a malformed settings image or full firmware image through an update channel that does not enforce cryptographic image authentication; or (3) offline or physical flash access via hardware debug interfaces (JTAG, SWD) or external flash programmers. The vulnerability is explicitly unreachable through the normal Zephyr settings API, which enforces SETTINGS_MAX_NAME_LEN and would never write an oversized name, and is unreachable over any network interface. Triggering the bug additionally requires that the malformed entry be in flash before settings_load() runs at boot or subsystem init, or before settings_save() iterates existing entries. The affected code path is further limited to Zephyr builds with the NVS settings backend enabled at compile time.

The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, score 5.3) accurately captures the constrained threat model. Attack complexity is genuinely high: the vulnerability is only reachable by an actor with raw flash write capability, not through the normal settings API or any network interface. The primitive - a single deterministic NUL byte at an attacker-chosen stack offset - is a reliable denial-of-service path but not a reliable code execution primitive; the 'RCE' tag in the input metadata overstates impact relative to what the description supports. No KEV listing exists and no EPSS score was supplied, leaving exploitation probability unquantified, though the hard prerequisite of flash write access significantly limits the exploitable population. Risk is most elevated in deployment models that accept externally supplied firmware images without cryptographic verification, that share flash between trusted and untrusted co-resident components, or that expose physical debug interfaces without protection - operators relying on authenticated firmware update channels and partition isolation reduce real-world risk substantially below what a raw CVSS score implies.

An attacker with physical access to a Zephyr-based IoT sensor uses a JTAG debug probe or flash programmer to write a settings NVS entry whose name field is padded to a length exceeding 74 bytes directly into the device's flash settings partition, bypassing the normal settings API that would have rejected it. On the next power cycle, settings_load() processes the crafted entry: nvs_read() returns the full oversized length, and the unclamped NUL write lands well past the 74-byte stack buffer in settings_nvs_load(), corrupting adjacent stack frame data and triggering a CPU fault exception that halts normal device operation indefinitely.