What is the CVSS score of CVE-2026-5066?

CVE-2026-5066 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Zephyr are affected by CVE-2026-5066?

A memory corruption vulnerability in Zephyr RTOS versions 4.3 and earlier impacts TLS socket operations, potentially causing denial of service or enabling code execution on embedded devices using the…

How to fix or mitigate CVE-2026-5066?

24 hours: Inventory all systems running Zephyr RTOS versions ≤ 4.3 and assess network exposure of TLS endpoints. 7 days: Evaluate upgrade path to Zephyr RTOS versions > 4.3 and develop deployment plan for patches or alternatives. 30 days: Complete remediation through version upgrade or implement compensating controls for critical systems unable to upgrade immediately.

Zephyr CVE-2026-5066

EUVD-2026-34324 HIGH

Out-of-bounds Write (CWE-787)

2026-06-04 zephyr

Denial Of Service Memory Corruption Buffer Overflow RCE Zephyr

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable TLS but requires non-default session cache enabled and an attacker-influenced caller-supplied addrlen, so AC:H and PR:L; stack corruption yields full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 08, 2026 - 13:45 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 08, 2026 - 13:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 13:37 vuln.today

cvss_changed

Severity Changed

Jul 08, 2026 - 13:37 NVD

MEDIUM HIGH

CVSS changed

Jul 08, 2026 - 13:37 NVD

6.3 (MEDIUM) 8.8 (HIGH)

Analysis Generated

Jun 04, 2026 - 21:17 vuln.today

DescriptionNVD

A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. struct net_sockaddr is an opaque type, so an application can pass an addrlen larger than sizeof(struct net_sockaddr) (for example 128 bytes into a 24-byte stack buffer), causing the memcpy to read and write past the end of the address memory used by the TLS session cache. This out-of-bounds write can lead to a crash and denial of service, and potentially to arbitrary code execution.

AnalysisAI

Out-of-bounds write/read in Zephyr RTOS (versions ≤ 4.3) affects the TLS socket connect path when the TLS session cache is enabled, where tls_session_store() and tls_session_restore() memcpy a caller-supplied socket address into a fixed-size 24-byte stack buffer using an unvalidated, caller-controlled addrlen. Because struct net_sockaddr is opaque, an application can pass an oversized addrlen (e.g. 128 bytes), corrupting adjacent memory and causing a crash/denial of service, with potential for arbitrary code execution. Publicly available exploit code exists per the SSVC 'poc' status, but EPSS is very low (0.06%, 18th percentile) and it is not on CISA KEV.