What is the CVSS score of CVE-2026-1681?

CVE-2026-1681 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Zephyr RTOS CVE-2026-1681

EUVD-2026-29387 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-05-12 zephyr

Buffer Overflow Zephyr

6.1

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from Vendor (zephyr) · only source for this CVE.

CVSS VectorVendor: zephyr

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 06:45 vuln.today

CVE Published

May 12, 2026 - 05:39 nvd

MEDIUM 6.1

DescriptionCVE.org

Issuing an ICMP ping via the net ping shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the destination is recognized as a local address, both the echo request and the resulting echo reply are processed inline before the current frame returns. The nested input-path frames exceed the work-queue stack and trigger a stack overflow.

AnalysisAI

Stack overflow in Zephyr RTOS network stack allows local attackers to trigger a denial of service by issuing an ICMP ping to the device's own IPv4 address via the net ping shell command, causing recursive re-entry of the input path on the same work-queue stack and exhausting stack memory. The vulnerability requires local access and user interaction to execute the shell command, affecting systems with Zephyr network functionality enabled.

Technical ContextAI

Zephyr RTOS is an embedded operating system with a network stack implementation. The vulnerability exists in the ICMP echo request/reply processing logic within the network stack's input path. When a ping is directed to a local IPv4 address, the stack processes both the incoming echo request and the generated echo reply inline on the same execution context before the current frame returns. This recursive re-entry on a single work-queue stack violates stack depth assumptions, causing stack overflow (CWE-674: Uncontrolled Recursion). The issue is rooted in the network stack's handling of locally-destined packets, which are processed synchronously rather than queued for deferred processing.

RemediationAI

Patch or upgrade Zephyr RTOS to a version that resolves the recursive input-path issue in the ICMP echo handler - consult the GitHub Security Advisory (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6fcc-8rwr-w7xx) for exact patched version numbers. As a workaround, disable or restrict access to the net ping shell command in production deployments by removing the network shell module or enforcing access controls to the shell interface (trade-off: loss of diagnostics capability). Alternatively, disable ICMP processing on the device if ping functionality is not required (trade-off: loss of network diagnostics and potential routing protocol impacts). Systems without local shell access or user interaction capability are not at immediate risk from this vulnerability.