Zephyr RTOS CVE-2026-1679

Exploitation requires that the target device be built with and actively using the eswifi socket offload driver (the Inventek es-WiFi offload path) for its network stack, and requires the attacker to already have local code execution capable of invoking the socket send API - there is no direct remote reach, as stated explicitly in the description. The overflow is triggered specifically by a send call whose payload exceeds the size of the fixed eswifi->buf buffer. Limiting factors: the attack surface is local-only (AV:L), the attacker needs existing low-privilege code execution (PR:L), the vulnerable driver must be compiled in and in use (not all Zephyr deployments use eswifi offload), and SSVC marks the issue as non-automatable, all of which sharply reduce realistic exposure despite the 7.8 score.

This is a genuine but constrained local privilege/stability risk rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) is internally consistent with the description: exploitation requires local code already able to invoke the socket send API, so there is no remote reach despite the high 7.8 base score and the H/H/H impact triad (kernel memory corruption affects confidentiality, integrity and availability). The signals align rather than conflict - EPSS is very low (0.03%, 10th percentile), the vulnerability is NOT on CISA KEV, and the CISA SSVC decision framework rates Exploitation as only 'poc', Automatable 'no', and Technical Impact 'partial'. All of these point to low likelihood of widespread opportunistic exploitation. The one upward signal is the SSVC 'poc' exploitation status indicating proof-of-concept-level exploit code, but this does NOT equal active exploitation. Net: a high-severity local memory-corruption bug worth patching on affected Zephyr builds, but not a drop-everything priority given the local-only attack surface, absence of KEV listing, non-automatable nature, and low EPSS.

On a Zephyr-based device whose networking stack uses the eswifi socket offload driver, an attacker who can already run local code (e.g. a compromised or malicious application thread) calls the socket send API with an oversized payload. The payload exceeds the fixed eswifi->buf buffer and overflows into adjacent kernel memory, corrupting kernel state to crash the device or potentially redirect execution. SSVC indicates proof-of-concept exploit code exists, but exploitation is not automatable and requires pre-existing local code execution.