What is the CVSS score of CVE-2026-1679?

CVE-2026-1679 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Zephyr are affected by CVE-2026-1679?

CVE-2026-1679 is a high-severity buffer overflow in Zephyr RTOS eswifi socket driver that allows authenticated local users to corrupt kernel memory, leading to potential privilege escalation or…

How to fix or mitigate CVE-2026-1679?

Within 24 hours: Inventory all Zephyr RTOS deployments using eswifi socket offload functionality and assess exposure to authenticated local users. Within 7 days: Implement network segmentation to restrict untrusted application access to socket APIs and apply OS-level privilege restrictions where feasible. Within 30 days: Monitor Zephyr project repositories and vendor advisories for patch availability; prepare deployment plan for critical systems once fix is released.

Zephyr CVE-2026-1679

HIGH

Classic Buffer Overflow (CWE-120)

2026-03-28 vulnerabilities@zephyrproject.org

Buffer Overflow Zephyr Zephyrproject

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 00:22 vuln.today

CVE Published

Mar 28, 2026 - 00:16 nvd

HIGH 7.3

DescriptionCVE.org

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi->buf, corrupting kernel memory (CWE-120). Exploit requires local code that can call the socket send API; no remote attacker can reach it directly.

AnalysisAI

Buffer overflow in Zephyr RTOS eswifi socket offload driver allows authenticated local attackers to corrupt kernel memory through oversized socket send operations. The vulnerability enables privilege escalation and denial of service via heap corruption, with high integrity and availability impact. No public exploit identified at time of analysis, though the attack vector is straightforward for users with socket API access. CVSS 7.3 reflects moderate-high severity constrained by local-only access requiring low-level privileges.

Technical ContextAI

The eswifi driver implements socket offloading for ESP8266/ESP32 WiFi modules in Zephyr RTOS embedded systems. The vulnerability stems from unsafe buffer handling (CWE-120: Buffer Copy without Checking Size of Input) where user-controlled send() payloads are copied into a fixed-size kernel buffer (eswifi->buf) without bounds validation. This classic stack or heap overflow occurs in the kernel space of the real-time operating system, allowing arbitrary memory corruption. The offload architecture moves TCP/IP stack processing to the WiFi coprocessor, but the driver's kernel-side buffer management fails to enforce size constraints before memcpy or similar operations. Zephyr Project's security advisory GHSA-qx3g-5g22-fq5w provides authoritative details on the affected driver component.

RemediationAI

Apply the vendor-released patch from the Zephyr Project by upgrading to the fixed version specified in GitHub security advisory GHSA-qx3g-5g22-fq5w at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qx3g-5g22-fq5w. Organizations using Zephyr RTOS should rebuild firmware with the patched driver code that implements proper bounds checking on socket send buffer sizes. As a temporary workaround if patching is not immediately feasible, disable the eswifi socket offload functionality and use alternative WiFi drivers or native Zephyr network stack implementations, though this may impact performance and require architectural changes. Review and restrict local code execution permissions on Zephyr devices to minimize the pool of processes that can invoke socket APIs, reducing attack surface until patches are deployed.