EUVD-2026-33449Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local code execution as userspace app
-
DeliveryOpen SocketCAN socket
-
ExploitCall sendto with truncated frame length
-
ExecutionNET_ASSERT skipped in production build
-
Persistsocketcan_to_can_frame reads past buffer
-
ImpactLeak adjacent memory on CAN bus or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to run a userspace application on the Zephyr device that can invoke the sendto syscall against a SocketCAN socket, and the target must be a production build where NET_ASSERT assertions are compiled out (the default in production, but debug/test images with assertions enabled are NOT vulnerable). The attacker must control the length argument passed to sendto and supply a truncated socketcan_frame. Limiting factors: local access with at least low privileges is required (AV:L/PR:L, no remote path), SocketCAN networking must be enabled in the build, and the CAN socket interface must be reachable by the attacking process; no user interaction is needed. |
| Impact | The signals converge on a real but low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms this needs local access and some privileges - a userspace app running on the device - so it is not remotely exploitable. EPSS is 0.01% (2nd percentile) and CISA's SSVC framework rates Exploitation: none, Automatable: no, Technical Impact: partial, all of which argue against imminent mass exploitation. There is no KEV listing and no public exploit code identified. Two caveats: the published 7.8 score assigns C:H/I:H/A:H, but an out-of-bounds *read* does not plausibly deliver a High integrity impact - the realistic impacts are information disclosure (leaked memory can be transmitted onto the CAN network) and denial of service (crash), so the integrity metric appears overstated. Exploitation also depends on the device being built with assertions disabled, which is normal for production but means debug/test images are not affected. |
| Exploit ScenarioDerived | A malicious or compromised userspace application on a Zephyr device opens a SocketCAN socket and calls sendto() with a socketcan_frame buffer whose length is deliberately shorter than a complete frame. Because the production build has NET_ASSERT compiled out, socketcan_to_can_frame() reads past the buffer, either crashing the device (DoS) or serializing adjacent memory into the CAN frame that is then transmitted on the bus, leaking secrets. No public proof-of-concept has been identified, and the local access requirement (AV:L/PR:L) limits this to attackers who already have code execution on the target. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 08, 2026
Out-of-bounds read in the Zephyr RTOS SocketCAN implementation lets a local userspace application leak adjacent memory or crash the system by submitting a truncated CAN frame through the sendto syscall. The zcan_sendto_ctx() path guards the user-supplied buffer length only with a NET_ASSERT, which is compiled out of production builds, so socketcan_to_can_frame() then dereferences fields past the end of the buffer. All Zephyr versions up to and including 4.3 are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile).
Earlier versions of this analysis (2)
Out-of-bounds read in the Zephyr RTOS SocketCAN stack lets a local, low-privileged userspace application crash the system or leak adjacent kernel memory onto the CAN bus. Affecting Zephyr versions up to and including 4.3, the flaw stems from frame-length validation that relies on a NET_ASSERT which is compiled out of production builds, so a truncated frame supplied via sendto() is dereferenced past its buffer. No public exploit identified at time of analysis; EPSS is negligible (0.01%) and SSVC records no known exploitation.
Out-of-bounds read in Zephyr RTOS SocketCAN implementation exposes production systems to denial-of-service crashes and adjacent memory disclosure via a crafted sendto() syscall. Local low-privileged userspace applications can supply a truncated socketcan_frame buffer whose length bypasses validation in zcan_sendto_ctx() - because the sole guard is a NET_ASSERT statement that is compiled out in production builds - causing socketcan_to_can_frame() to dereference fields beyond the buffer boundary. No public exploit code has been identified at time of analysis, but the affected CPE covers all versions of Zephyr RTOS, and exploitation is limited to local access with low privileges (CVSS AV:L/PR:L).
RemediationAI
Upgrade to a Zephyr release beyond 4.3 that contains the fix; the GHSA advisory (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3w6-x7m3-3c58) is the authoritative source for the exact patched version, which is not independently confirmed from the available data - no fixed version string was provided, so treat patch availability as per-vendor-advisory only. As a compensating control until patching, add an unconditional length check in zcan_sendto_ctx() before calling socketcan_to_can_frame(), or if you build your own image temporarily keep NET_ASSERT enabled in the affected build (trade-off: assertions increase code size and halt the system on trigger, which may be undesirable in production). Operationally, restrict which userspace applications may open and write to SocketCAN sockets, since exploitation requires a local process that can issue the sendto syscall on a CAN socket. See https://vuldb.com/vuln/367420 for supplementary tracking.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zephyr is an open-source real-time operating system for resource-constrained embedded and IoT devices. The flaw lives in its SocketCAN networking layer, which exposes a BSD-style socket API over the CAN (Controller Area Network) bus. When a userspace application calls sendto() with a socketcan_frame object, zcan_sendto_ctx() is supposed to verify that the caller-supplied length is large enough to hold a full frame, but it does so with a NET_ASSERT - a debug-only assertion that is disabled (compiled to a no-op) in production builds. socketcan_to_can_frame() subsequently reads frame fields (such as CAN ID, DLC, and data bytes) at fixed offsets, and with a truncated buffer those reads fall past the allocation boundary. This is a classic CWE-125 out-of-bounds read caused by trusting an assertion for security-relevant input validation rather than an unconditional runtime check.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local userspace app with low privileges controls the sendto length (AV:L/PR:L/AC:L); the OOB read yields memory disclosure (C:H) and crashes (A:H) but modifies no state, so I:N rather than the reported I:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.
Executive ViewAI
Zephyr RTOS SocketCAN module (all versions through 4.3) contains an out-of-bounds memory read vulnerability that allows local applications to leak sensitive kernel memory or trigger denial of service. Organizations deploying Zephyr in embedded or IoT systems where untrusted local code execution is possible face confidentiality and availability risk; however, exploitation requires local system access and no active exploitation has been observed.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local userspace process privilege level and remove unnecessary Linux capabilities, particularly CAP_NET_RAW; (2) Deploy seccomp filters to block sendto syscalls on untrusted processes; (3) Disable SocketCAN functionality entirely where not operationally required; (4) Implement kernel-level sandboxing via SELinux/AppArmor to isolate critical network components; (5) Monitor Zephyr project repository and security mailing list for patch release tracking.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB