Zephyr RTOS EUVD-2026-35348

Exploitation requires that the target Zephyr image was built with CONFIG_HTTP_SERVER_WEBSOCKET enabled and that the HTTP server is bound to a network interface reachable by the attacker. No authentication, no user interaction, and no prior foothold are required, matching CVSS PR:N/UI:N. The attacker must be able to send a single TCP/HTTP request to the listening port and must craft the Sec-WebSocket-Key header to be exactly the size of the parser's fixed-size buffer so that the bounded copy omits the trailing NUL - sending a short, RFC-compliant key will not trigger the bug. Reliable code execution (as opposed to just crash/DoS) additionally depends on the target board lacking stack canaries and having a predictable stack layout, which is common but not universal on Zephyr targets.

All signals converge toward high priority: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N indicates trivially reachable network exploitation without authentication or user interaction, and full C/I/A impact. CWE-170 leading to stack-based OOB write is a classic memory corruption primitive with realistic code execution potential on embedded targets that typically lack stack canaries, ASLR, or W^X protections, raising the practical RCE likelihood above what it would be on a hardened OS. EPSS and CISA KEV data were not provided in the input, so no public exploit identified at time of analysis and no confirmation of active exploitation; however, given the simplicity of the trigger (a single oversized Sec-WebSocket-Key header) public PoCs are likely to appear quickly. The mitigating factor is exposure scope: only devices that both enable CONFIG_HTTP_SERVER_WEBSOCKET and expose the HTTP server on a reachable network are at risk, which on IoT/OT fleets can still be substantial.

An attacker on the same network as an exposed Zephyr-based IoT device (for example, a smart sensor, industrial gateway, or medical device) sends a single HTTP GET request to the device's HTTP server with an Upgrade: websocket header and an oversized Sec-WebSocket-Key value that exactly fills the parser's fixed buffer with no embedded NUL. The malformed header triggers an out-of-bounds read followed by an out-of-bounds write during the magic-string concatenation, immediately crashing the device or, with careful payload crafting on a target without stack protections, redirecting execution to attacker-controlled shellcode. No public exploit identified at time of analysis, but the trigger is simple enough to develop with curl and a known firmware image.