# CVE-2026-10636: Zephyr OS use-after-free in IPv4 IGMP implementation

Source: https://junglewise.ai/threats/cve-2026-10636-zephyr-os-use-after-free-in-ipv4-igmp-implementation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-16. Updated: 2026-06-16  
License: CC BY 4.0 with a link back

CVE-2026-10636 · Severity: low · CVSS 3.7 · Published 2026-06-16

Zephyr is an open-source operating system designed for resource-constrained Internet of Things (IoT) devices. A flaw in how the system handles certain IPv4 network traffic (IGMP) could allow a remote attacker to cause a device to crash or behave unpredictably. This occurs because the system attempts to access data from a network packet after that packet has already been processed and released from memory.

Technologies: [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-10636 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10636 being exploited in the wild.

**How severe is CVE-2026-10636?** Low severity, with a CVSS score of 3.7, published 16 June 2026.

**Which products and versions are affected?** Zephyr Project Zephyr OS v2.6.0 through v4.4.0.

**Is there a fix for CVE-2026-10636?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10636 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-10636?** Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in `subsys/net/ip/igmp.c` within the `igmp_send()` function. The root cause is that the code calls `net_pkt_iface(pkt)` to retrieve the network interface pointer after the packet has been passed to `net_send_data()`. In common configurations (NET_TC_TX_COUNT=0), the packet's reference count may reach zero and be returned to the memory slab before `igmp_send()` finishes. If `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the resulting dangling pointer is dereferenced to update statistics. An unauthenticated remote attacker can trigger this path by sending IPv4 IGMP membership queries to the 224.0.0.1 multicast address. The vulnerability was fixed in version 4.5.0 by caching the interface pointer before the packet is sent.

## Affected products

- Zephyr Project Zephyr OS v2.6.0 through v4.4.0

## Timeline

- 2021-04: other: Vulnerability introduced in v2.6.0 with IGMPv2 support
- 2026-06-16: advisory: GHSA-fj6q-975v-65c9 published
- 2026-06-16: disclosed

## References

- [https://github.com/zephyrproject-rtos/zephyr/commit/0223e5e3ec5ebc51e8d0328fc3e604fa43552f54](https://github.com/zephyrproject-rtos/zephyr/commit/0223e5e3ec5ebc51e8d0328fc3e604fa43552f54)
- [https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj6q-975v-65c9](https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj6q-975v-65c9)

## Related threats

- [Zephyr MCTP over USB use-after-free in packet buffer handling](https://junglewise.ai/threats/cve-2026-85032-the-mctp-over-usb-device-class-in-subsys-pmci-mctp-mctp-usb-c)
- [Zephyr arm64 MMU TLB invalidation memory isolation bypass](https://junglewise.ai/threats/cve-2026-79979-the-arm64-mmu-backend-invalidates-a-single-virtual-address-from)
- [Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsing](https://junglewise.ai/threats/cve-2026-76787-the-updatehub-firmware-over-the-air-client-parses-the-coap-probe)
- [CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsing](https://junglewise.ai/threats/cve-2026-75084-the-cc1200-sub-ghz-ieee-802-15-4-driver-takes-the-phy-packet)
- [Zephyr Bluetooth Link Layer memory leak in connection update](https://junglewise.ai/threats/cve-2026-19739-the-bluetooth-link-layer-control-procedure-code-in-subsys)