Zephyr RTOS CVE-2026-18416

Requires the target to run the Zephyr CoAP server subsystem with CONFIG_COAP_SERVER_WELL_KNOWN_CORE enabled (default y) so that /.well-known/core is served, AND at least one registered resource must declare struct coap_core_metadata attributes so match_queries_resource() reaches the vulnerable path. The attacker must also supply a Uri-Query href= value that is a strict prefix of a longer registered resource path segment for the inner loop to over-read. No authentication or user interaction is needed (PR:N/UI:N), but AC:H reflects that the over-read is probabilistic (each extra byte is read only if it equals the next path character) and produces no observable output - it cannot influence the response or disclose data, which severely limits practical exploitation.

This is a genuinely low-risk issue despite a network attack vector. The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) is consistent with the description: reachable remotely and unauthenticated (PR:N), but with high complexity (AC:H) and only a marginal availability impact (A:L), no confidentiality or integrity impact. There is no EPSS score, no CISA KEV listing, and no public exploit code identified, so all severity/exploitation signals align on low priority. Critically, the description itself limits impact more strongly than the vector might suggest: the CWE-125 out-of-bounds read stays within a stack-local copy (struct coap_option.value[12]), NOT the receive buffer, reads only the uninitialized tail (in practice a single byte), cannot influence the CoAP response, and produces undefined behaviour rather than information disclosure. This is a real defensive-hygiene fix but not an operational priority. Note the CWE-125 (out-of-bounds READ) contradicts the 'Buffer Overflow' tag (which implies a write), and the 'Information Disclosure' tag directly contradicts the description, which explicitly states the flaw is 'not information disclosure.'

An unauthenticated attacker who can reach a Zephyr-based CoAP device sends GET /.well-known/core?href=/<prefix> where <prefix> is a prefix of a longer registered resource path that declares coap_core_metadata attributes. The match_path_uri() inner loop then reads one or a few bytes past the end of the option-value copy on the stack, causing undefined behaviour. No public exploit code exists, and the read neither discloses data to the attacker nor alters the response, so the practical outcome is limited to potential undefined behaviour.