EUVD-2026-39478Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device over IPv6
-
DeliveryCraft fragmented IPv6 packets
-
ExploitTrigger fragment-header buffer leak
-
ExecutionRepeat to exhaust RX slab
-
ImpactDevice stops receiving traffic (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup on lifecycle end
|
| Exploitation Conditions | Exploitation requires that the target runs Zephyr's IPv6 network stack with IPv6 fragment reassembly enabled and that the attacker can deliver IPv6 packets to the device (same L2 segment or routed IPv6 reachability). The trigger is a crafted maliciously fragmented IPv6 packet that exercises the fragment-header processing path; repeating it a small number of times exhausts the finite RX buffer slab. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or non-default complexity is needed. Limiting factors: devices without IPv6 enabled, without IPv6 fragment reassembly support, or unreachable over IPv6 (behind a NAT/gateway or on isolated networks) are not exploitable, and recovery is possible via device reboot. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent and credible: a remote, unauthenticated attacker with low complexity and no user interaction can trigger the leak, and impact is confined to availability - there is no code execution or data exposure. The description's claim that only 'a small number' of packets is needed aligns with the small RX slab sizes typical of embedded Zephyr builds, making the attack cheap and reliable once a target is reachable. No EPSS score, SSVC decision, KEV entry, or POC was provided, so probabilistic exploitation signals are absent; the realistic risk is therefore driven by exposure rather than confirmed in-the-wild use. The principal mitigating factor is reachability - many Zephyr devices sit behind gateways or on non-routable segments and never expose IPv6 to untrusted networks - but for internet- or LAN-exposed IPv6-enabled devices this is a high-priority availability bug because the effect is persistent and requires physical/manual recovery. Verify the exact patched version directly from the GHSA advisory, as no fix version was supplied in the input. |
| Exploit ScenarioDerived | An attacker on the same network segment as - or with IPv6 routability to - a Zephyr-based IoT device sends a short burst of malformed fragmented IPv6 packets to its address. Each packet leaks one RX buffer in the fragment-processing path, and after the small slab is drained the device silently stops receiving any traffic and effectively drops off the network until manually rebooted. No authentication, user interaction, or special tooling is required (low CVSS attack complexity), and no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Remote denial of service in the Zephyr RTOS IPv6 network stack lets unauthenticated attackers permanently halt packet reception by sending a small number of crafted fragmented IPv6 packets. Each malicious fragment leaks its RX network buffer (CWE-772) instead of returning it to the memory slab, so a handful of packets exhausts the fixed RX buffer pool and the device stops receiving all traffic until reboot. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 7.5 (A:H only) reflects high availability impact with no confidentiality or integrity exposure.
RemediationAI
Upgrade to the patched Zephyr release identified in the vendor advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cv4q-2j56-4wqf and rebuild and reflash affected firmware - an upstream fix is referenced by the advisory, but the exact released version was not provided in the input and must be confirmed from that advisory before rollout. Where immediate patching is impractical on fielded embedded devices, compensating controls include: disabling IPv6 in the Zephyr build (CONFIG_NET_IPV6) if the application does not require it, which eliminates the vulnerable path but breaks any IPv6 functionality; disabling IPv6 fragment reassembly (CONFIG_NET_IPV6_FRAGMENT) if enabled, which closes the specific code path at the cost of dropping legitimately fragmented IPv6 traffic; and at the network layer, blocking or rate-limiting inbound IPv6 fragmented packets (IPv6 with a fragment extension header) at an upstream gateway or filtering untrusted IPv6 reachability to the device, which reduces exposure but does not fix the underlying leak. Increasing the RX buffer slab size only raises the number of packets needed and does not remediate the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zephyr is a small-footprint, RTOS widely used in resource-constrained IoT and embedded devices, where networking is provided by its built-in TCP/IP stack. Incoming packets are stored in net_pkt/net_buf RX buffers carved from a statically sized memory slab pool - a deliberate design for deterministic, low-RAM operation that also means buffer exhaustion is catastrophic rather than merely degrading. The flaw is a CWE-772 'Missing Release of Resource after Effective Lifetime': the IPv6 fragment-header (extension header) processing path fails to free the associated RX packet buffer when handling a malicious fragment, so each such packet permanently consumes one slot in the finite slab. Because the pool does not refill, the leak is monotonic and irreversible without a restart, distinguishing it from transient congestion.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated packets trigger it with no interaction (AV:N/AC:L/PR:N/UI:N); impact is a persistent buffer-exhaustion DoS only, so A:H with C:N/I:N.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
DescriptionCVE.org
Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. Repeating the malicious packet exhausts all RX buffer slots, after which the device can no longer obtain RX buffers and stops receiving traffic, resulting in a denial of service.
Executive ViewAI
Zephyr RTOS systems used in production IoT and embedded deployments can be forced offline by remote, unauthenticated attackers with no patch currently available. This creates immediate service disruption risk across affected infrastructure, requiring manual device reboots and compensating network controls to mitigate.
Network-layer: implement rate limiting and drop policies for fragmented IPv6 packets at perimeter firewalls; apply network segmentation to restrict Zephyr device accessibility. Device-level: disable IPv6 if operationally unnecessary. Operational: establish alerting for packet reception halts or rapid buffer exhaustion; document manual recovery procedures (device reboot). No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB