EUVD-2026-34324Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 08, 2026
Out-of-bounds write/read in Zephyr RTOS (versions ≤ 4.3) affects the TLS socket connect path when the TLS session cache is enabled, where tls_session_store() and tls_session_restore() memcpy a caller-supplied socket address into a fixed-size 24-byte stack buffer using an unvalidated, caller-controlled addrlen. Because struct net_sockaddr is opaque, an application can pass an oversized addrlen (e.g. 128 bytes), corrupting adjacent memory and causing a crash/denial of service, with potential for arbitrary code execution. Publicly available exploit code exists per the SSVC 'poc' status, but EPSS is very low (0.06%, 18th percentile) and it is not on CISA KEV.
Earlier versions of this analysis (2)
Out-of-bounds read/write in the Zephyr RTOS network sockets subsystem (sockets_tls.c) affects all releases through 4.3 when the TLS session cache is enabled, letting an oversized caller-supplied addrlen overflow a fixed-size 24-byte stack buffer during TLS connect. The corruption reliably crashes the device (denial of service) and may permit arbitrary code execution on the embedded target. SSVC records a proof-of-concept, but EPSS is very low (0.06%, 18th percentile) and the flaw is not in CISA KEV, so exploitation is currently theoretical/targeted rather than widespread.
Out-of-bounds write in Zephyr RTOS's TLS session cache allows an authenticated network attacker to corrupt stack memory in the TLS socket subsystem, leading to denial of service and potentially arbitrary code execution. The vulnerability affects the tls_session_store() and tls_session_restore() functions in subsys/net/lib/sockets/sockets_tls.c when TLS session caching is enabled, triggered by supplying an oversized addrlen value that causes an unchecked memcpy to overflow a 24-byte stack buffer with up to 128 bytes of attacker-influenced data. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the RCE potential is elevated on MCU targets that typically lack OS-level memory protections such as ASLR or stack canaries.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable TLS but requires non-default session cache enabled and an attacker-influenced caller-supplied addrlen, so AC:H and PR:L; stack corruption yields full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. struct net_sockaddr is an opaque type, so an application can pass an addrlen larger than sizeof(struct net_sockaddr) (for example 128 bytes into a 24-byte stack buffer), causing the memcpy to read and write past the end of the address memory used by the TLS session cache. This out-of-bounds write can lead to a crash and denial of service, and potentially to arbitrary code execution.
Executive ViewAI
A memory corruption vulnerability in Zephyr RTOS versions 4.3 and earlier impacts TLS socket operations, potentially causing denial of service or enabling code execution on embedded devices using the affected RTOS. Organizations deploying Zephyr in production systems should prioritize inventory and risk assessment to prevent system compromises and operational outages.
24 hours: Inventory all systems running Zephyr RTOS versions ≤ 4.3 and assess network exposure of TLS endpoints. 7 days: Evaluate upgrade path to Zephyr RTOS versions > 4.3 and develop deployment plan for patches or alternatives. 30 days: Complete remediation through version upgrade or implement compensating controls for critical systems unable to upgrade immediately.
No vendor-released patch identified at time of analysis. Interim mitigations: disable TLS session caching on vulnerable systems if functionality permits, restrict network access to affected devices through network segmentation and firewall rules, implement enhanced monitoring for unexpected system crashes or TLS connection failures that may indicate exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB