Zephyr RTOS EUVD-2026-95529

Requires the target to be built with CONFIG_USERSPACE together with CONFIG_DYNAMIC_OBJECTS (the latter also selected by CONFIG_DYNAMIC_THREAD under userspace), and the attacker must control a user-mode thread that has an assigned resource pool. The attacker needs the ability to execute code as an unprivileged thread inside the Zephyr userspace sandbox and to issue the k_object_alloc_size() syscall (or k_thread_stack_alloc() for the stack-element branch). The CONFIG_GEN_PRIV_STACKS option enables the additional wild-pointer-as-privileged-stack-base primitive. Limiting factors: this is local (AV:L) and requires an already-running unprivileged thread (PR:L); devices that do not enable the userspace sandbox or dynamic objects, or threads without a resource pool, are not exploitable.

This is a genuine high-priority local privilege-escalation / sandbox-escape flaw, and the signals are internally consistent rather than inflated. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.8) correctly models the vulnerability: an attacker must already be running an unprivileged user-mode thread (AV:L, PR:L), but the integer overflow (CWE-190) in dynamic_object_create() lets that thread drive a supervisor-mode out-of-bounds write into the kernel resource-pool heap, crossing the CONFIG_USERSPACE trust boundary (S:C) with full C/I/A impact. No EPSS score, KEV entry, or public PoC is present in the input, so there is no evidence of active exploitation - the risk is driven by technical severity, not observed attacks. The confirmed vendor patch and commit diff (adding overflow checks before z_thread_aligned_alloc) strongly corroborate the root cause and exploitability. The key caveat is that real-world exposure is gated by configuration: exploitation requires CONFIG_USERSPACE plus CONFIG_DYNAMIC_OBJECTS and a calling thread with an assigned resource pool, so devices without the userspace sandbox or dynamic objects are not affected. Net: a real priority for Zephyr deployments that use the userspace security model, but not a mass-exploitation Internet-facing threat given the local attack vector and config dependency.

An unprivileged user-mode thread already running inside the Zephyr userspace sandbox calls the k_object_alloc_size() (or k_thread_stack_alloc()) syscall with a size near SIZE_MAX, causing the backing-allocation arithmetic to wrap to a few bytes while the object is still registered with its full type. The attacker then invokes the matching init syscall (e.g. k_mutex_init(), k_sem_init(), or k_thread_create()), which writes a full-sized kernel object over the truncated heap chunk, corrupting sys_heap metadata and adjacent kernel objects to achieve kernel memory corruption or code execution. No public exploit is identified at time of analysis, but the vendor commit diff confirms the exact overflowing computations.