Zephyr RTOS CVE-2026-8718

Three conditions must all be satisfied simultaneously. First, the firmware must be compiled with CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID=y, which is not a default Kconfig option. Second, the attacking thread must have an established DTLS connection on which the remote peer has negotiated a Connection ID of at least 1 byte - meaning the remote endpoint must also support and enable DTLS CID. Third, for the kernel-heap overflow path (the highest-impact variant), CONFIG_USERSPACE=y must be enabled, which partitions the address space and routes getsockopt through the syscall verifier that performs the fatal undersized allocation. Without CONFIG_USERSPACE, the overflow still occurs but is confined to the process heap rather than the kernel allocator. Exploitation is further limited to threads that already have an open, connected DTLS socket file descriptor; network-remote attackers who have not already achieved local code execution cannot trigger this path directly.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H, score 8.4) accurately reflects the attack conditions: local access with low privileges and no interaction required, crossing a privilege boundary into the kernel. The scope change (S:C) is well-justified because the overflow targets kernel-heap memory from a userspace thread. Real-world risk is meaningfully constrained by three stacked prerequisites: the DTLS Connection ID feature must be compiled in (CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID), an active DTLS session with a negotiated peer CID must exist, and CONFIG_USERSPACE must be enabled for the most impactful kernel-crossing path. These are non-default Kconfig options typically found only in purpose-built embedded networking firmware. EPSS data was not provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC lower the immediate urgency compared to the raw CVSS score. Teams operating embedded IoT gateways or mesh network nodes on Zephyr v3.5.0 and later with DTLS CID enabled should treat this as a priority patch, while projects not using DTLS CID can deprioritize. The overflow content is the remote peer's CID, limiting attacker control over what bytes are written beyond the buffer boundary.

An attacker with code execution as an unprivileged user thread on a Zephyr device - for example, via a compromised application partition - establishes or reuses a DTLS session on a socket with Connection ID negotiated. The thread calls getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE) with an optlen smaller than 32 bytes, causing the syscall verifier to allocate an undersized kernel heap buffer and mbedtls_ssl_get_peer_cid() to write the peer CID beyond the allocation boundary, potentially corrupting adjacent kernel heap objects. No public POC is available at time of analysis, so successful exploitation would currently require custom tooling and knowledge of the target's heap layout.