What is the CVSS score of EUVD-2026-55805?

EUVD-2026-55805 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Zephyr UpdateHub are affected by EUVD-2026-55805?

Zephyr RTOS versions 3.7.0 through 4.4.1 contain a remotely triggerable denial-of-service vulnerability in the UpdateHub firmware-update mechanism that crashes and resets affected devices without…. A patch is available.

How to fix or mitigate EUVD-2026-55805?

Within 24 hours, inventory all systems running Zephyr RTOS versions 3.7.0 through 4.4.1 and begin testing vendor patch 4.4.2 in non-production environments to validate compatibility and verify UpdateHub functionality post-upgrade. Within 7 days, deploy the patch to all non-critical systems and complete pre-deployment validation for critical infrastructure, documenting any compatibility issues. Within 30 days, upgrade all remaining systems to Zephyr RTOS 4.4.2 or later, and verify that DTLS is enabled on all UpdateHub communication channels to prevent network-based exploitation during any interim period.

Zephyr UpdateHub EUVD-2026-55805

| CVE-2026-11810 HIGH

NULL Pointer Dereference (CWE-476)

2026-08-10 zephyr

Buffer Overflow Denial Of Service Information Disclosure Null Pointer Dereference Zephyr Zephyrproject

7.5

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Server compromise or network MITM is required, neither achievable at will, warranting AC:H over the vendor's AC:L; all other metrics match the description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 10, 2026 - 21:21 vuln.today

Analysis Generated

Aug 10, 2026 - 21:21 vuln.today

CVE Published

Aug 10, 2026 - 20:23 cve.org

HIGH 7.5

DescriptionCVE.org

The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length (objects_len != 2) and then dereferences objects[1].objects[0].objects.sha256sum via strlen() without checking that the inner object array of element [1] is non-empty.

The metadata is attacker-influenceable network input: the agent fetches it over CoAP from the configured UpdateHub server during its routine OTA probe. A malicious or compromised update server (or, when DTLS is disabled, a network man-in-the-middle) can return a response whose second outer object array is empty. Because the parse target is zero-initialised, the corresponding objects[1].objects[0].objects.sha256sum pointer is NULL, and the subsequent strlen() dereferences address zero. The same defect exists in both the 'any boards' and 'some boards' metadata layouts.

The resulting CPU fault is fatal under Zephyr's default error handling, halting or resetting the device, so the flaw is a remotely triggerable denial of service. Impact is limited to availability; it is a read from NULL with no out-of-bounds write, memory corruption, or information disclosure. The fix rejects metadata whose inner object array is empty before any dereference, on both layouts.

AnalysisAI

Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.

Technical ContextAI

The vulnerable component is the UpdateHub subsystem (subsys/mgmt/updatehub/updatehub.c) within the Zephyr real-time operating system (CPE: cpe:2.3:a:zephyrproject:zephyr). UpdateHub is an OTA firmware distribution mechanism that communicates with a configured update server over CoAP, optionally protected by DTLS. The JSON response is deserialized into a fixed two-level nested-array C struct covering both 'any boards' and 'some boards' metadata layouts. CWE-476 (NULL Pointer Dereference) is the root cause: the code validates that the outer array has exactly two elements but does not check that the inner array at objects[1] is non-empty. Because the struct is zero-initialized, an empty inner array leaves the sha256sum char-pointer NULL. The subsequent strlen() on that pointer dereferences address zero. Under Zephyr's default hard-fault handler this is an unrecoverable CPU exception, causing device halt or reset. The fix, visible in commit 3424082022cb39d568434021b1d6f68b6a7fb3bf, adds an explicit objects_len == 0 guard before any dereference in both layout paths.

RemediationAI

Upgrade to Zephyr RTOS 4.4.2 or later, which incorporates the fix introduced in upstream commit 3424082022cb39d568434021b1d6f68b6a7fb3bf; the patch adds inner-array length checks before any pointer dereference in both the 'any boards' and 'some boards' code paths, returning UPDATEHUB_METADATA_ERROR on malformed responses. The advisory and patch are at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jfpc-324j-84ww and https://github.com/zephyrproject-rtos/zephyr/commit/3424082022cb39d568434021b1d6f68b6a7fb3bf respectively. Where an immediate upgrade is not possible, enabling DTLS on all CoAP UpdateHub sessions eliminates the network MITM path, though it does not protect against a compromised update server. Additionally, restricting outbound device traffic so that UpdateHub probes can only reach the legitimate OTA server IP reduces the server-impersonation surface. Disabling the UpdateHub subsystem entirely eliminates the attack surface at the cost of losing OTA update capability until patching is feasible.