Zephyr CC1200 Driver EUVD-2026-101341

Exploitation requires that the target build enables CONFIG_IEEE802154_CC1200 with a physically attached CC1200 sub-GHz radio configured for variable packet length (PKT_LEN=0xFF), which is the driver's default and makes the length byte an over-the-air 0-255 value. The attacker must be within sub-GHz radio range (Adjacent) and must craft a frame whose first-byte length exceeds 127 while keeping the 128-byte RX FIFO from overflowing so the RX_FIFO_ERROR pre-check stays clear. Limiting factors that reduce real-world risk: High attack complexity from RF framing/timing dependence (the RX thread samples the FIFO off PKT_SYNC_RXTX and may read before a packet completes), reliance on the default net_buf configuration (CONFIG_NET_BUF_FIXED_DATA_SIZE with CONFIG_NET_BUF_DATA_SIZE=128), and the fact that the overflow writes FIFO-underflow bytes rather than attacker-chosen data - so impact is corruption/crash, not controlled code execution. No pairing, authentication, or user interaction is required.

This is a genuine but constrained memory-safety flaw (CWE-787 out-of-bounds write) rather than a top-tier emergency. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 6.8 Medium) is internally consistent with the description: exploitation requires only radio range (Adjacent, no authentication, no user interaction) but carries High attack complexity because reaching the vulnerable state depends on RF framing and timing - the RX thread samples the FIFO off the PKT_SYNC_RXTX signal and the attacker must present a length byte above 127 while the 128-byte FIFO has not overflowed so the RX_FIFO_ERROR pre-check does not fire. No EPSS score, KEV entry, or POC was provided in the input, so exploitation likelihood signals are absent: no public exploit identified at time of analysis, and the flaw is not on CISA KEV. The practical impact is also self-limiting - the overflowing bytes are FIFO-underflow output, not attacker-chosen data, so the realistic outcome is net_buf pool corruption and device crashes (denial of service) rather than controlled code execution. The C:N/I:H/A:H impact split arguably overstates integrity, since the write content is uncontrolled; the dominant real-world effect is availability loss. Net: a real priority only for the narrow population running Zephyr with CONFIG_IEEE802154_CC1200 and an attached CC1200 radio in RF-reachable deployments; patch-when-able rather than drop-everything for most fleets.

An unauthenticated attacker within sub-GHz radio range of a Zephyr device using the CC1200 802.15.4 driver transmits a crafted PHY frame whose first byte declares a length greater than the 802.15.4 maximum of 127 (up to 255) while keeping the chip's 128-byte RX FIFO from overflowing. The unclamped length drives net_pkt_rx_alloc_with_buffer() and a single SPI burst read that writes up to 127 bytes past the end of a fragment in the rx_bufs pool, corrupting the network-buffer pool and crashing the device. No public exploit is identified at time of analysis; success depends on RF framing and timing because the RX thread may sample the FIFO before a packet is complete.