What is the CVSS score of CVE-2026-13351?

CVE-2026-13351 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Zephyr RTOS are affected by CVE-2026-13351?

Zephyr RTOS systems used in production IoT and embedded deployments can be forced offline by remote, unauthenticated attackers with no patch currently available.

How to fix or mitigate CVE-2026-13351?

24 hours: Inventory all Zephyr RTOS deployments (versions, network exposure, business criticality). 7 days: Implement network-level rate limiting on fragmented IPv6 traffic; isolate critical Zephyr devices to restricted network segments; configure syslog alerting for RX buffer depletion. 30 days: Monitor vendor security advisories for patch availability; evaluate IPv6 filtering or device deactivation where operationally feasible; plan device upgrade or replacement timeline.

Zephyr RTOS CVE-2026-13351

EUVD-2026-39478 HIGH

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-06-25 zephyr

Denial Of Service Zephyr Zephyrproject Rtos

7.5

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated packets trigger it with no interaction (AV:N/AC:L/PR:N/UI:N); impact is a persistent buffer-exhaustion DoS only, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 17:20 vuln.today

DescriptionCVE.org

Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. Repeating the malicious packet exhausts all RX buffer slots, after which the device can no longer obtain RX buffers and stops receiving traffic, resulting in a denial of service.

AnalysisAI

Remote denial of service in the Zephyr RTOS IPv6 network stack lets unauthenticated attackers permanently halt packet reception by sending a small number of crafted fragmented IPv6 packets. Each malicious fragment leaks its RX network buffer (CWE-772) instead of returning it to the memory slab, so a handful of packets exhausts the fixed RX buffer pool and the device stops receiving all traffic until reboot. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 7.5 (A:H only) reflects high availability impact with no confidentiality or integrity exposure.

Technical ContextAI

Zephyr is a small-footprint, RTOS widely used in resource-constrained IoT and embedded devices, where networking is provided by its built-in TCP/IP stack. Incoming packets are stored in net_pkt/net_buf RX buffers carved from a statically sized memory slab pool - a deliberate design for deterministic, low-RAM operation that also means buffer exhaustion is catastrophic rather than merely degrading. The flaw is a CWE-772 'Missing Release of Resource after Effective Lifetime': the IPv6 fragment-header (extension header) processing path fails to free the associated RX packet buffer when handling a malicious fragment, so each such packet permanently consumes one slot in the finite slab. Because the pool does not refill, the leak is monotonic and irreversible without a restart, distinguishing it from transient congestion.

RemediationAI

Upgrade to the patched Zephyr release identified in the vendor advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cv4q-2j56-4wqf and rebuild and reflash affected firmware - an upstream fix is referenced by the advisory, but the exact released version was not provided in the input and must be confirmed from that advisory before rollout. Where immediate patching is impractical on fielded embedded devices, compensating controls include: disabling IPv6 in the Zephyr build (CONFIG_NET_IPV6) if the application does not require it, which eliminates the vulnerable path but breaks any IPv6 functionality; disabling IPv6 fragment reassembly (CONFIG_NET_IPV6_FRAGMENT) if enabled, which closes the specific code path at the cost of dropping legitimately fragmented IPv6 traffic; and at the network layer, blocking or rate-limiting inbound IPv6 fragmented packets (IPv6 with a fragment extension header) at an upstream gateway or filtering untrusted IPv6 reachability to the device, which reduces exposure but does not fix the underlying leak. Increasing the RX buffer slab size only raises the number of packets needed and does not remediate the flaw.