What is the CVSS score of CVE-2026-5071?

CVE-2026-5071 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Zephyr RTOS are affected by CVE-2026-5071?

Zephyr RTOS SocketCAN module (all versions through 4.3) contains an out-of-bounds memory read vulnerability that allows local applications to leak sensitive kernel memory or trigger denial of…

How to fix or mitigate CVE-2026-5071?

24 hours: Inventory all production systems running Zephyr RTOS and determine which implement SocketCAN functionality and permit untrusted local process execution. 7 days: Apply mandatory privilege restrictions to local userspace-disable SocketCAN access for non-critical processes, enforce SELinux/AppArmor profiles limiting capability set to CAP_NET_RAW only where required, and restrict sendto syscalls via seccomp. 30 days: Establish upgrade path to Zephyr 4.4 or later once patched version is released; monitor Zephyr security advisories weekly for hotfix availability.

Zephyr RTOS CVE-2026-5071

EUVD-2026-33449 HIGH

Out-of-bounds Read (CWE-125)

2026-05-30 zephyr

Information Disclosure Buffer Overflow Zephyr

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Local userspace app with low privileges controls the sendto length (AV:L/PR:L/AC:L); the OOB read yields memory disclosure (C:H) and crashes (A:H) but modifies no state, so I:N rather than the reported I:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 08, 2026 - 13:47 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 08, 2026 - 13:46 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 13:37 vuln.today

cvss_changed

Severity Changed

Jul 08, 2026 - 13:37 NVD

MEDIUM HIGH

CVSS changed

Jul 08, 2026 - 13:37 NVD

6.1 (MEDIUM) 7.8 (HIGH)

Analysis Generated

May 30, 2026 - 08:27 vuln.today

DescriptionNVD

The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.

AnalysisAI

Out-of-bounds read in the Zephyr RTOS SocketCAN implementation lets a local userspace application leak adjacent memory or crash the system by submitting a truncated CAN frame through the sendto syscall. The zcan_sendto_ctx() path guards the user-supplied buffer length only with a NET_ASSERT, which is compiled out of production builds, so socketcan_to_can_frame() then dereferences fields past the end of the buffer. All Zephyr versions up to and including 4.3 are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile).

Technical ContextAI

Zephyr is an open-source real-time operating system for resource-constrained embedded and IoT devices. The flaw lives in its SocketCAN networking layer, which exposes a BSD-style socket API over the CAN (Controller Area Network) bus. When a userspace application calls sendto() with a socketcan_frame object, zcan_sendto_ctx() is supposed to verify that the caller-supplied length is large enough to hold a full frame, but it does so with a NET_ASSERT - a debug-only assertion that is disabled (compiled to a no-op) in production builds. socketcan_to_can_frame() subsequently reads frame fields (such as CAN ID, DLC, and data bytes) at fixed offsets, and with a truncated buffer those reads fall past the allocation boundary. This is a classic CWE-125 out-of-bounds read caused by trusting an assertion for security-relevant input validation rather than an unconditional runtime check.

RemediationAI

Upgrade to a Zephyr release beyond 4.3 that contains the fix; the GHSA advisory (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3w6-x7m3-3c58) is the authoritative source for the exact patched version, which is not independently confirmed from the available data - no fixed version string was provided, so treat patch availability as per-vendor-advisory only. As a compensating control until patching, add an unconditional length check in zcan_sendto_ctx() before calling socketcan_to_can_frame(), or if you build your own image temporarily keep NET_ASSERT enabled in the affected build (trade-off: assertions increase code size and halt the system on trigger, which may be undesirable in production). Operationally, restrict which userspace applications may open and write to SocketCAN sockets, since exploitation requires a local process that can issue the sendto syscall on a CAN socket. See https://vuldb.com/vuln/367420 for supplementary tracking.