Executive brief
Zephyr OS, a popular operating system for embedded and IoT devices, contains a flaw in how it processes network addresses. An attacker could send a specially crafted network address containing an excessively long port number to crash the device or potentially take control of it. This affects devices using Zephyr for networking, including those handling DNS or Wi-Fi communications.
Technical details
A stack-based buffer overflow exists in `parse_ipv4()` and `parse_ipv6()` within `subsys/net/ip/utils.c`. When parsing address strings in the format "a.b.c.d:port" or "[addr]:port", the code copies the port substring into a fixed-size stack buffer (17 bytes for IPv4) using a length derived from the unbounded input string without verifying the destination buffer's limits. This vulnerability is reachable via `net_ipaddr_parse()`, which is used by the standard socket API (`zsock_getaddrinfo`), DNS configuration, and certain Wi-Fi co-processor paths. An attacker can trigger an out-of-bounds write by providing a long suffix after the colon delimiter. Patches have been merged into the main branch and backported to stable releases (v4.4, v4.3, v3.7).
Affected products
- Zephyr Project Zephyr OS v1.9.0 to v4.4.0
Timeline
- 2026-07-12: advisory: GHSA-532c-7g7f-jhmh published
- 2026-07-12: disclosed: CVE-2026-10666 published
References
- https://github.com/zephyrproject-rtos/zephyr
- https://github.com/zephyrproject-rtos/zephyr/commit/1c8d19a51f9a3c1be6de53854c8ad8c2720a0f48
- https://github.com/zephyrproject-rtos/zephyr/commit/6e119a636a57be449ea21e73cad762ebc6f5ff7a
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-532c-7g7f-jhmh