Is CVE-2026-10636 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10636 being exploited in the wild.

How severe is CVE-2026-10636?

Low severity, with a CVSS score of 3.7, published 16 June 2026.

Which products and versions are affected?

Zephyr Project Zephyr OS v2.6.0 through v4.4.0.

Is there a fix for CVE-2026-10636?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10636 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-10636?

Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10636: Zephyr OS use-after-free in IPv4 IGMP implementation

CVE-2026-10636 · Severity: low · CVSS 3.7 · Published 2026-06-16

Zephyr is an open-source operating system designed for resource-constrained Internet of Things (IoT) devices. A flaw in how the system handles certain IPv4 network traffic (IGMP) could allow a remote attacker to cause a device to crash or behave unpredictably. This occurs because the system attempts to access data from a network packet after that packet has already been processed and released from memory.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-10636 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10636 being exploited in the wild.
How severe is CVE-2026-10636?: Low severity, with a CVSS score of 3.7, published 16 June 2026.
Which products and versions are affected?: Zephyr Project Zephyr OS v2.6.0 through v4.4.0.
Is there a fix for CVE-2026-10636?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10636 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-10636?: Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in `subsys/net/ip/igmp.c` within the `igmp_send()` function. The root cause is that the code calls `net_pkt_iface(pkt)` to retrieve the network interface pointer after the packet has been passed to `net_send_data()`. In common configurations (NET_TC_TX_COUNT=0), the packet's reference count may reach zero and be returned to the memory slab before `igmp_send()` finishes. If `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the resulting dangling pointer is dereferenced to update statistics. An unauthenticated remote attacker can trigger this path by sending IPv4 IGMP membership queries to the 224.0.0.1 multicast address. The vulnerability was fixed in version 4.5.0 by caching the interface pointer before the packet is sent.

Affected products

Zephyr Project Zephyr OS v2.6.0 through v4.4.0

Timeline

2021-04: other: Vulnerability introduced in v2.6.0 with IGMPv2 support
2026-06-16: advisory: GHSA-fj6q-975v-65c9 published
2026-06-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.