Zephyr RTOS CVE-2026-5072

Exploitation requires the attacker to be present on an adjacent Layer 2 or directly routable network segment shared with the target device (AV:A per CVSS vector) - internet-remote exploitation is not possible without additional routing or tunneling infrastructure. The Zephyr PTP subsystem must be compiled into the firmware image and actively running on the target device; deployments that do not use PTP are not affected. The attack requires a two-step message sequence: first a PTP_MSG_MANAGEMENT message to inject the malicious log_announce_interval value, then a PTP_MSG_ANNOUNCE message to trigger the vulnerable timer computation. Authentication is not required (PR:N per CVSS vector). The SSVC automatable rating of 'no' reflects that this two-step stateful interaction prevents trivial spray-and-pray exploitation. Crash behavior versus silent starvation outcome depends on the target CPU architecture and compiler, limiting predictable exploitation across heterogeneous fleets.

The CVSS 3.1 base score of 6.5 (Medium) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects a network-adjacent, unauthenticated, low-complexity availability-only impact. The adjacent-network requirement (AV:A) meaningfully constrains exploitability compared to internet-facing vulnerabilities: the attacker must share a Layer 2 broadcast domain or directly routable segment with the target. EPSS at 0.05% (17th percentile) is consistent with very low observed exploitation activity. SSVC signals reinforce this: Exploitation is 'none', Automatable is 'no' (the attack requires a two-message sequence with a specific intervening state transition), and Technical Impact is 'partial' (availability only, no code execution or data exposure). This vulnerability is not in the CISA KEV catalog. Combined, these signals characterize the risk as moderate-priority for embedded deployments where PTP is active and network segments are shared with untrusted devices (e.g., factory floors, shared IoT LANs), but low-priority for air-gapped or PTP-disabled deployments. The deterministic crash path on certain compiler/architecture combinations elevates operational risk for high-availability embedded targets despite the medium CVSS score.

An attacker positioned on the same local network segment as a Zephyr-based embedded device - such as a shared industrial Ethernet network or IoT subnet - sends a crafted PTP_MSG_MANAGEMENT frame specifying a log_announce_interval value of -127. The device stores this unvalidated value in its port data set. When the attacker subsequently sends a PTP_MSG_ANNOUNCE message, the device's timer function computes NSEC_PER_SEC >> 127, invoking undefined behavior; on architectures where the compiler emits an illegal instruction trap for this condition, the device crashes immediately, causing a denial of service. No public exploit code has been identified at time of analysis.