EUVD-2026-37114Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to local link segment
-
DeliveryCraft MLDv2 General Query (unspecified addr, hop limit 1)
-
Exploithandle_mld_query triggers send_mld_report/mld_send
-
Executionnet_send_data frees packet, iface read after free
-
PersistDereference NULL/stale interface pointer
-
ImpactCrash networking stack (DoS) or stray-write corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be on the same local link (adjacent network, AV:A) and to send a valid MLDv2 General Query (unspecified multicast source address, hop limit 1) to the ICMPv6 MLD Query handler; no authentication or user interaction is needed. Two build-time conditions gate the actual bug: the target must have IPv6 MLD enabled so handle_mld_query() is registered, and CONFIG_NET_STATISTICS_PER_INTERFACE must be enabled for the freed interface pointer to be dereferenced in the statistics path. Reliability is limited by a race: the outcome depends on whether the freed net_pkt slot in the k_mem_slab has been concurrently reallocated (NULL read yields a clean crash; stale pointer yields the narrow memory-corruption case). Exposure is further limited to devices reachable on an untrusted L2 segment - routed, point-to-point, or trusted links substantially reduce practical risk. |
| Impact | The signals are internally consistent and point to a real but bounded DoS priority rather than a critical remote-code-execution emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, base 7.1) correctly limits reach to the adjacent local link and reflects the dominant availability impact (A:H) with only low integrity impact (I:L) from the narrow corruption possibility and no confidentiality impact. EPSS is low at 0.18% (8th percentile), it is NOT listed in CISA KEV, and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: partial - all agreeing that this is not a widely-exploited or wormable issue. The low EPSS is consistent (not conflicting) with the adjacency requirement and lack of known exploitation. The most likely realistic outcome is a reliable link-local crash of the networking stack; memory corruption requires winning a reallocation race and is described by the vendor as a 'narrow possibility,' so it should be treated as plausible-but-unproven rather than a confirmed code-execution path. Priority is elevated for exposed embedded/IoT fleets on shared L2 segments, lower for devices behind trusted or point-to-point links. |
| Exploit ScenarioDerived | An attacker positioned on the same local link (for example a rogue device on a shared LAN or Wi-Fi segment) sends a valid MLDv2 General Query with the unspecified multicast address and hop limit 1 to a Zephyr device. handle_mld_query() responds via send_mld_report() -> mld_send(), which dereferences the freed packet's interface pointer, crashing the networking stack; under concurrent packet-slab reuse this can instead produce a stray write. No public exploit code has been identified, and exploitation is unauthenticated but limited to the adjacent network with low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 01, 2026
Remotely triggerable denial of service in the Zephyr RTOS networking stack (versions 1.12.0 through 4.4.x) arises from a use-after-free in the IPv6 MLD code path, where mld_send() reads net_pkt_iface(pkt) after net_send_data() has already transferred packet ownership and the L2 driver freed it back to its memory slab. An unauthenticated attacker on the local link can elicit the vulnerable path by sending a crafted MLDv2 General Query, causing a NULL-pointer dereference crash or, in a narrow race, memory corruption via a stray statistics increment. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.
Earlier versions of this analysis (2)
Remotely triggerable denial of service in the Zephyr RTOS IPv6 networking stack allows an unauthenticated attacker on the local link to crash the network stack (and, in a narrow race, corrupt memory) by sending a crafted MLDv2 General Query. The flaw is a use-after-free in mld_send(): the packet's interface is read after net_send_data() has already transferred ownership and freed the net_pkt. All Zephyr releases from 1.12.0 up to 4.5.0 are affected. No public exploit has been identified; EPSS is low (0.18%) and CISA SSVC lists exploitation as none, indicating no observed in-the-wild activity.
Use-after-free in Zephyr RTOS's IPv6 MLD subsystem (subsys/net/ip/ipv6_mld.c) allows any unauthenticated adjacent-link attacker to crash the networking stack - and in a narrow race window, corrupt memory - by sending a well-formed MLDv2 General Query ICMPv6 packet. The mld_send() function violates Zephyr's explicit packet-ownership contract by dereferencing the freed net_pkt interface pointer in the per-interface statistics path after net_send_data() has already returned ownership to the L2 driver. No public exploit or CISA KEV listing exists at time of analysis; the upstream fix is available as a source-code commit but a specific patched release version has not been independently confirmed.
RemediationAI
Vendor-released patch: upgrade to Zephyr 4.5.0, which fixes the flaw by caching the interface in a local variable (__maybe_unused struct net_if *iface = net_pkt_iface(pkt)) before net_send_data() and no longer touching the packet afterward, per commit 3159c53e8e7d233c2a85a0798cf25ac441db6dae and advisory GHSA-m23w-34pp-4h92. For devices that cannot be updated immediately, the most direct compensating control is to disable CONFIG_NET_STATISTICS_PER_INTERFACE in the build, which removes the vulnerable statistics dereference entirely at the cost of losing per-interface network counters; alternatively, where IPv6 multicast is not required, disabling IPv6 MLD support removes reachability of handle_mld_query()/mld_send() but breaks IPv6 multicast group management. At the network layer, restrict or filter link-local MLDv2 General Queries to trusted routers and segment vulnerable devices onto isolated L2 domains so untrusted hosts cannot reach them on the local link; note this only mitigates the adjacent-network exposure and does not remove the code defect. Because the patch is a small, well-understood localized change already proven in the IGMP sibling, upgrading is strongly preferred over workarounds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zephyr is a small-footprint real-time operating system for resource-constrained embedded and IoT devices, including its own IPv6/ICMPv6 networking stack. The root cause is CWE-416 (Use After Free): the network stack enforces an ownership contract (documented in include/zephyr/net/net_core.h and warned about explicitly at subsys/net/ip/net_core.c:453-460, 'do not use pkt after that call') whereby a successful net_send_data() hands the net_pkt to the L2 driver, which unrefs and returns it to its k_mem_slab (e.g. ethernet_send() at subsys/net/l2/ethernet/ethernet.c:790). In subsys/net/ip/ipv6_mld.c, mld_send() nonetheless calls net_pkt_iface(pkt) on the already-freed packet and passes the recovered interface pointer into the per-interface statistics path (net_stats.h UPDATE_STAT/SET_STAT) when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. If the freed slot has been concurrently reallocated, the interface field can read back as NULL (crash) or as a stale/garbage pointer (out-of-bounds increment write / corruption). The affected product per CPE is cpe:2.3:a:zephyrproject:zephyr:*. The IPv4/IGMP sibling igmp_send() already used the safe pattern of caching the interface before sending.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Reachable unauthenticated only on the local link (AV:A, PR:N) and reliably triggerable (AC:L); dominant availability crash (A:H) with only a race-dependent stray write giving low integrity impact (I:L) and no confidentiality impact.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ownership contract (include/zephyr/net/net_core.h, and the explicit warning in subsys/net/ip/net_core.c:453-460 'do not use pkt after that call'), a successful send transfers ownership of the net_pkt and the L2 driver frees it (e.g. ethernet_send() unrefs the packet on success, subsys/net/l2/ethernet/ethernet.c:790), returning it to its k_mem_slab. The subsequent net_pkt_iface(pkt) is therefore a read of a freed object; the recovered interface pointer is then dereferenced and incremented by the per-interface statistics path (net_stats.h UPDATE_STAT/SET_STAT) when CONFIG_NET_STATISTICS_PER_INTERFACE is enabled. If the freed slot is concurrently reallocated, pkt-iface may read back as NULL (NULL-pointer dereference / crash) or as a stale/garbage pointer (stray increment write / memory corruption). The path is reachable remotely on the local link without authentication: handle_mld_query() (registered for NET_ICMPV6_MLD_QUERY) responds to a valid MLDv2 General Query (unspecified multicast address, hop limit 1) by calling send_mld_report() - mld_send(). The result is a remotely triggerable denial of service of the networking stack, with a narrow possibility of memory corruption. The fix caches the interface in a local before sending and no longer touches the packet after net_send_data(). The IPv4/IGMP sibling (igmp_send) already used the corrected pattern.
Executive ViewAI
Zephyr RTOS versions 1.12.0 through 4.4.x contain a remotely triggerable denial-of-service vulnerability affecting IoT, edge computing, and embedded systems, with no public exploit identified at time of analysis. Local network attackers can crash vulnerable devices by sending crafted network queries, causing service interruptions and operational downtime. A vendor patch is available and should be prioritized for immediate deployment planning across affected device inventory.
Apply vendor patch. Until patching is complete, implement network segmentation to restrict local-link access to vulnerable Zephyr devices and enable monitoring for anomalous MLDv2 General Query traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB