What is the CVSS score of EUVD-2026-104600?

EUVD-2026-104600 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-104600?

Within 24 hours, have the physical security and embedded engineering teams inventory all Zephyr-based products running CONFIG_OSDP with CONFIG_OSDP_MODE_CP and an event callback registered, and confirm which firmware builds are on site; restrict physical access to RS-485 cabling and reader wiring closets, and review OSDP bus segments for unknown or unauthorized readers. Within 7 days, obtain the vendor's advisory for CVE-2026-76788 and the corresponding fixed Zephyr release, schedule a firmware update for the highest-exposure panels - entry points, lobby doors, and any panel reachable from an unsecured reader - and, where a vendor build is not yet available, work with the vendor on a temporary build that bounds reply payload lengths in cp_decode_response() or disables the event callback until remediated. Within 30 days, complete firmware rollout to all remaining affected panels, add OSDP bus monitoring or secure-channel enforcement to detect anomalous reply frames, and fold this component into the asset inventory and patch cadence for operational technology so future Zephyr advisories are triaged as part of the door-access program.

Zephyr OSDP EUVD-2026-104600

| CVE-2026-76788 HIGH

Out-of-bounds Write (CWE-787)

2026-10-19 zephyr

Buffer Overflow Memory Corruption Zephyr Zephyrproject

8.8

CVSS 3.1 · Vendor: zephyr

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain access to OSDP RS-485 bus
Delivery

Forge reply frame with valid CRC and sequence
Exploit

Send oversized REPLY_KEYPPAD/REPLY_RAW to CMD_POLL
Execution

Overflow 64-byte event array via memcpy
Persist

Overwrite return address on receive-thread stack
Impact

Crash panel or hijack control flow

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires a build with CONFIG_OSDP enabled in CONFIG_OSDP_MODE_CP (Control Panel) mode with an application event callback registered - the normal CP integration. The attacker must be on the OSDP RS-485 bus (a malicious/compromised card reader or physical access to the wiring) and must send a frame with correct SOM, valid CRC-16, and a matching 2-bit sequence number, all computable or observable from the bus. Limiting factors: exploitation is bus-adjacent only (not remote/network), and requires the OSDP CP subsystem to be compiled in and active. CONFIG_OSDP_SC_ENABLED (secure channel) only mitigates while a secure channel is active, but a single unauthenticated frame carrying a bad MAC triggers sc_deactivate(), after which plaintext replies are again accepted - so secure channel is not a reliable barrier. No reply-ID-to-outstanding-command binding exists, so an oversized reply is accepted as the answer to a routine CMD_POLL.
Impact	This is a genuine high-priority defect for the specific population that runs it, though its blast radius is bounded by the attack vector. The CVSS 8.8 vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is credible and matches the description: exploitation requires presence on the OSDP RS-485 bus (Adjacent, not Network), needs no privileges, and yields full C/I/A impact via a stack overflow that can reach saved registers and the return address (Zephyr ships without stack canaries by default). No EPSS score, KEV listing, or public POC was supplied in the intelligence set - exploitation status is therefore 'no public exploit identified at time of analysis', and risk scoring rests on the vector and the confirmed patch rather than observed exploitation. The one point of friction worth flagging: AC:L is defensible because SOM, CRC-16 and the 2-bit sequence number are all computable or observable by anyone on the wire, and secure channel (CONFIG_OSDP_SC_ENABLED) can be stripped by a single bad-MAC frame that forces sc_deactivate() - but it is NOT remotely reachable, so despite C/I/A all High this is not an internet-facing mass-exploitation candidate. Net: a real, patch-now issue for deployed OSDP control panels, not a high-CVSS-but-low-real-risk artifact, but its reach is gated by physical/bus adjacency.
Exploit ScenarioDerived	A malicious or compromised peripheral card reader - or anyone who can tap the RS-485 wiring of an access-control installation - sends a crafted REPLY_KEYPPAD or REPLY_RAW frame with a valid SOM, CRC-16 and matching sequence number as the unsolicited answer to a routine CMD_POLL. The oversized payload overruns the fixed 64-byte (OSDP_EVENT_MAX_DATALEN) stack array in struct osdp_event, writing roughly 180 bytes of attacker-chosen data over saved registers and the return address of the OSDP receive thread. No public exploit code was identified in the provided data; outcomes range from a hard crash of the control panel to potential control-flow hijack.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 19, 2026

A stack-based out-of-bounds write in Zephyr's OSDP Control Panel reply parser (cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c) lets an attacker on the RS-485 bus overflow fixed 64-byte payload arrays inside a stack-allocated struct osdp_event by declaring an oversized REPLY_KEYPPAD or REPLY_RAW payload length. Any build with CONFIG_OSDP and CONFIG_OSDP_MODE_CP plus an event callback registered is affected, and because nobody validates the reply ID against an outstanding command, a malicious or compromised card reader can answer a routine CMD_POLL with a weaponized frame carrying a correct SOM, valid CRC-16 and matching sequence number. With the default 256-byte UART buffer roughly 180 attacker-chosen bytes land past the event object, corrupting saved registers and the return address on typical Cortex-M/RISC-V layouts, giving crash-to-potential-control-flow-hijack in the OSDP receive thread; no public exploit code has been identified at time of analysis and the issue is bus-adjacent (AV:A) rather than network-reachable.

RemediationAI

Apply the upstream fix commit f10d55f47c6970e95d3a7c6ba08e6adec3c79acd (or a Zephyr release that contains it, per advisory GHSA-fgg7-h8p9-9q3w), which adds the missing OSDP_EVENT_MAX_DATALEN bound to both the REPLY_KEYPPAD and REPLY_RAW branches of cp_decode_response() and caps each memcpy() at its destination size; patch status is 'Upstream fix available (PR/commit); released patched version not independently confirmed', so verify the commit is present in your pinned tree before relying on a version number. If immediate patching is not possible, reduce exposure in this order: drop CONFIG_OSDP_MODE_CP (or CONFIG_OSDP entirely) on products that do not need to act as a Control Panel - this removes the vulnerable parser outright at the cost of the OSDP feature; lower CONFIG_OSDP_UART_BUFFER_LENGTH from the 256-byte default to shrink the maximum possible overwrite (it cannot eliminate the overflow, and it reduces the largest frame the CP can accept); enable CONFIG_MPU_STACK_GUARD and, where the architecture supports it, stack canaries so an overwrite faults the OSDP receive thread instead of yielding control-flow hijack (costs a small amount of RAM/cycles and converts silent corruption into a reboot); run the OSDP receive thread unprivileged behind the MPU so corrupted execution cannot reach privileged resources. Treat CONFIG_OSDP_SC_ENABLED as a partial mitigation only - a single bad-MAC frame triggers sc_deactivate() and returns the link to plaintext - so pair it with strict physical protection of the RS-485 cabling and reader enrollment, since anyone with bus access can compute the SOM, CRC-16 and sequence number needed to deliver the frame.

Affected VersionsENISA

Zephyr 3.3.0 ≤4.4.2

Affected Packages

euvd zephyr no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

OSDP (Open Supervised Device Protocol) is the RS-485 access-control protocol implemented by Zephyr's subsys/mgmt/osdp subsystem, where a Control Panel (CP) polls Peripheral Devices such as card readers. cp_process_reply() reads bytes off the UART, runs osdp_phy_check_packet() and osdp_phy_decode_packet() for framing/CRC validation, then dispatches on reply ID into cp_decode_response(). For REPLY_KEYPPAD and REPLY_RAW, the handler copies the attacker-controlled payload into struct osdp_event_keypress / struct osdp_event_cardread whose data arrays are sized OSDP_EVENT_MAX_DATALEN (64 bytes); the only guard was that the declared length matched the number of bytes actually present in the frame, which is meaningless when the attacker controls both values. The sibling REPLY_FMT branch already carried the missing '> OSDP_EVENT_MAX_DATALEN' bound, confirming this is an omission rather than a design choice. The root cause is CWE-787 (out-of-bounds write): an unchecked length derived from untrusted wire data is used directly as the memcpy() count into a fixed-size stack destination, and Zephyr does not enable stack canaries by default, so a write of ~180 bytes past the object overwrites saved registers and the return address. Note that CONFIG_OSDP_SC_ENABLED (secure channel) is not a reliable barrier: it only protects while a secure channel is established, and a single unauthenticated frame with a bad MAC calls sc_deactivate(), after which plaintext replies are accepted again.

Know when Zephyr gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (zephyr) PRIMARY 8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

AV:A because exploitation is confined to the RS-485 bus; AC:L and PR:N since SOM/CRC/sequence are observable and secure channel can be stripped by one bad-MAC frame; C/I/A:H from potential control-flow hijack.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation performed is that the declared length is self-consistent with the number of payload bytes present in the frame. Because the attacker controls both the length field and the frame length, that check imposes no bound, and the subsequent memcpy() writes into the fixed 64-byte data arrays of struct osdp_event_keypress / struct osdp_event_cardread (OSDP_EVENT_MAX_DATALEN). The sibling REPLY_FMT handler in the same switch already carried the missing > OSDP_EVENT_MAX_DATALEN bound.

The defect is reached from cp_process_reply(), which reads bytes from the OSDP RS-485 channel and passes them through osdp_phy_check_packet() and osdp_phy_decode_packet() before dispatching on the reply ID. Triggering it requires CONFIG_OSDP with CONFIG_OSDP_MODE_CP and an application event callback registered (the normal Control Panel integration), plus a frame carrying a correct SOM, a valid CRC-16, and a matching 2-bit sequence number - all of which are computable or observable by anyone on the bus. No check ties the reply ID to the outstanding command, so an oversized REPLY_KEYPPAD or REPLY_RAW is accepted as the answer to a routine CMD_POLL. A malicious or compromised card reader, or anyone with access to the RS-485 wiring, can supply such a frame; CONFIG_OSDP_SC_ENABLED only helps while a secure channel is active, and a single unauthenticated frame carrying a bad MAC causes sc_deactivate(), after which plaintext replies are again accepted.

With the default CONFIG_OSDP_UART_BUFFER_LENGTH of 256, roughly 180 bytes of fully attacker-chosen data can be written past the end of the stack-allocated event object, over saved registers and the return address on typical Cortex-M and RISC-V frame layouts (Zephyr does not enable stack canaries by default). The impact ranges from a hard crash of the access-control panel to potential control-flow hijack in the context of the OSDP receive thread. The fix adds an OSDP_EVENT_MAX_DATALEN bound to both handlers, capping each memcpy() at the size of its destination.

Technical POC Analysis

CWE-787 (out-of-bounds write) in cpdecoderesponse() in subsys/mgmt/osdp/src/osdpcp.c (Zephyr).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Executive ViewAI

Why It Matters

Zephyr-based OSDP control panels - the units that manage card readers on door and building access systems - contain a memory-corruption flaw in how they parse reader replies, allowing a malicious or compromised reader on the shared RS-485 wiring to crash the panel and potentially seize control of its processing flow. Leadership should care because these devices sit at the boundary between cyber and physical security: a successful attack could disable or subvert door control at a site, and the affected code ships in any firmware build that enables OSDP control-panel mode with an event callback, meaning installed door infrastructure may already be exposed.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

Low

optional OSDP access-control subsystem in an embedded RTOS, industry-specific footprint

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Controlled

Automatable

Human Impact

Medium

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.