Zephyr RTOS CVE-2026-14368

The attacker must control or impersonate a LwM2M server with an active DTLS session to the target Zephyr client (CVSS PR:L reflects this authorized-peer requirement - unauthenticated or anonymous network access alone is not sufficient). The device must be compiled with Zephyr's LwM2M subsystem enabled (CONFIG_LWM2M) and must expose at least one LWM2M_RES_TYPE_STRING resource. Exploitation is only possible when the LwM2M WRITE uses JSON content format; the other formatters (TLV, plain text, CBOR, SenML CBOR, SenML JSON) are not affected. The exact crash or corruption outcome depends on runtime memory layout adjacent to the target buffer, which the attacker cannot control. Limiting factors: requires an authorized LwM2M server role with an established DTLS session; requires a STRING-typed resource target; and impact is constrained to a single deterministic NUL-byte write with layout-dependent consequences.

The CVSS 5.4 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) accurately reflects a network-reachable, low-complexity flaw requiring low-privilege access - specifically, an established LwM2M server role over a DTLS session. EPSS data is absent from the provided intelligence set, so exploitation probability cannot be quantified. KEV status is not confirmed and this CVE does not appear as actively exploited. No public exploit code has been identified, though the publicly visible commit diff and GHSA advisory substantially lower the barrier for an attacker to reproduce the flaw. Real-world risk is constrained by two factors: the overflow writes exactly one fixed byte (0x00) at a deterministic offset, and the actual damage depends on the platform's memory layout at runtime, which the attacker cannot control. This limits the primitive to a reliability/DoS concern or silent data corruption rather than a reliable code-execution path in most configurations; however, on safety-critical or resource-constrained embedded devices typical of Zephyr deployments, even a controllable crash or state corruption carries operational consequences beyond what the CVSS score alone suggests, and operators managing fleets of LwM2M-connected devices should treat patch deployment as a near-term priority.

A malicious or compromised LwM2M management server with an active DTLS session to a Zephyr client sends a CoAP WRITE request targeting a STRING-type resource, encoding a JSON string payload whose byte length exactly equals the resource's configured maximum buffer size. The client's do_write_op_json() parses the payload, invokes get_string(), which copies the string into the buffer and writes a NUL byte one position past the end, silently corrupting an adjacent memory field - potentially a length field, counter, flag, or neighboring resource value - resulting in a subsequent crash or undetected data mishandling.