Executive brief
Zephyr RTOS, an operating system for resource-constrained IoT devices, contains a flaw in how it handles firmware update requests. A remote management server or an attacker on the network can send a specially crafted update address that is longer than the device expects. This can cause the device to crash or leak sensitive internal memory to the attacker, potentially exposing system secrets or disrupting operations.
Technical details
An out-of-bounds read (CWE-125) exists in 'subsys/net/lib/lwm2m/lwm2m_pull_context.c' when 'CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT' is enabled. The 'lwm2m_pull_context_start_transfer' function uses 'memcpy' to copy a server-supplied Package URI into a fixed-size 'context.uri' buffer (default 128 bytes) without length validation or NUL termination. Because the source buffer in the Firmware-Update object is larger (255 bytes), a long URI causes subsequent 'strlen' calls and 'http_parser_parse_url' operations to read past the buffer boundary. This results in a crash (DoS) or the inclusion of adjacent memory in outbound CoAP requests (information disclosure). The issue is fixed in v4.5.0 and backported to v3.7.1, v4.2.1, and v4.3.0 by adding length checks and switching to 'strcpy'.
Affected products
- Zephyr Project Zephyr RTOS v3.0.0 to v4.4.0
Timeline
- 2026-07-14: advisory: GHSA-rf6j-4mpp-j9mf published
- 2026-07-14: disclosed: CVE-2026-10672 published
- 2026-07-14: patched: Fix committed to Zephyr main branch