Zephyr MCUmgr CVE-2026-18747

Requires a target built with a serial SMP transport that selects MCUMGR_TRANSPORT_SERIAL_HAS_SMP_OVER_CONSOLE - specifically CONFIG_MCUMGR_TRANSPORT_UART (smp_uart.c) or CONFIG_MCUMGR_TRANSPORT_SHELL (smp_shell.c); the test-only CONFIG_MCUMGR_TRANSPORT_DUMMY loopback shares the bug but has no external input path and is not exploitable. The attacker needs write access to that management console, which on many boards is an exposed USB CDC-ACM port rather than a physical UART header - this local-console access requirement (AV:L) is the primary limiting factor. No authentication, prior session state, fragmentation, or credentials are needed (PR:N, UI:N), as the malformed frame is processed before command-level access control. Reliable memory disclosure additionally depends on the default-enabled CONFIG_MCUMGR_GRP_OS_ECHO handler and on staging preceding frames to shape the reused pool buffer.

This is a real but access-constrained flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 6.8) is internally consistent with the description: exploitation requires write access to a local management console (UART or, on many boards, a USB CDC-ACM port), hence AV:L rather than AV:N, and it needs no credentials or session state because the malformed frame is mishandled before any command-level access control (PR:N). The dominant impact is availability (A:H - the OOB read faults the MCUmgr thread / can reset the device), with limited confidentiality (C:L) via the default os echo handler leaking adjacent memory, and no integrity gain beyond what the already-unauthenticated transport permits (I:N). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no signal of active or automated exploitation - this is a vendor-reported (Zephyr project) advisory with a confirmed source-level fix, not an in-the-wild threat. The AV:L local-console requirement is the single biggest risk limiter and correctly keeps this out of the remotely-wormable class despite PR:N; treat as a real defect to patch on exposed/physically-accessible devices, not an internet-facing emergency. Note the bare 7-byte trigger alone typically only re-parses stale pool bytes into a parse error; reliably reaching the faulting OOB read or memory disclosure requires the attacker to stage preceding frames - feasible precisely because the transport is unauthenticated and the attacker controls all console input.

An attacker with write access to a device's MCUmgr management console (a bare UART header or, commonly, an exposed USB CDC-ACM port) sends a single unauthenticated 7-byte line - the 0x06 0x09 packet marker, the base64 group AAA=, and a newline - declaring a zero-length packet that passes the CRC check for free and underflows net_buf::len to ~65 KB against a 384-byte buffer. To move from a mere parse error to a faulting out-of-bounds read or memory disclosure, the same unauthenticated attacker first stages preceding frames so that a request parses with nh_len larger than the buffer, driving net_buf_pull() (guarded only by __ASSERT_NO_MSG) out of bounds. No public exploit code was identified at time of analysis.