# CVE-2026-10773: The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const…

Source: https://junglewise.ai/threats/cve-2026-10773-the-dhcpv4-client-helper-net-dhcpv4-msg-type-name-in-subsys-net  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01  
License: CC BY 4.0 with a link back

CVE-2026-10773 · Severity: medium · CVSS 5.4 · Published 2026-08-01

The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds check. The guard used msg_type <= sizeof(name) instead of msg_type <= ARRAY_SIZE(name); sizeof returns the byte size of the pointer array (32 on 32-bit, 64 on 64-bit targets) rather than the element count of 8, so message-type values from 9 up to that byte size pass the check and cause name[msg_type - 1] to read past the end of the array.

The msg_type value originates from the DHCP MESSAGE TYPE option, which is read as an unchecked raw byte from a received packet (net_pkt_read_u8) and passed unmodified into the lookup. A DHCP server, or any host able to inject a spoofed DHCP reply onto the client's link, can therefore drive the index out of bounds. The out-of-range slot yields a garbage const char * that is then dereferenced by a %s log conversion.

The lookup is reached only from a debug log statement (NET_DBG / LOG_DBG), so the out-of-bounds read is triggerable only when the DHCPv4 log module is built at DEBUG level (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), which is not the default configuration. When that condition holds, the result is an out-of-bounds read and a wild-pointer dereference: most likely a crash of the DHCP client (denial of service) and potentially disclosure of an adjacent pointer's contents through the log output. The fix replaces sizeof with ARRAY_SIZE, restoring the correct 1..8 acceptance window.

Technologies: [Zephyrproject Zephyr](https://junglewise.ai/threats/technologies/zephyrproject-zephyr). Vendors: [Zephyrproject](https://junglewise.ai/threats/vendors/zephyrproject).

## Quick answers

**Is CVE-2026-10773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10773 being exploited in the wild.

**How severe is CVE-2026-10773?** Medium severity, with a CVSS score of 5.4, published 1 August 2026.

**Which products and versions are affected?** Zephyrproject Zephyr. The advisory does not name versions.

**Is there a fix for CVE-2026-10773?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-10773?** Check whether you run Zephyrproject Zephyr. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Zephyrproject Zephyr

## Related threats

- [The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning…](https://junglewise.ai/threats/cve-2026-11368-the-bluetooth-host-att-layer-subsys-bluetooth-host-att-c)
- [The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update…](https://junglewise.ai/threats/cve-2026-10849-the-hawkbit-device-management-client-in-subsys-mgmt-hawkbit)
- [Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration…](https://junglewise.ai/threats/cve-2026-2411-zephyr-s-bluetooth-host-declares-a-gatt-characteristic-as-two)
- [The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space…](https://junglewise.ai/threats/cve-2026-1679-the-eswifi-socket-offload-driver-copies-user-provided-payloads)
- [dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the…](https://junglewise.ai/threats/cve-2026-1678-dns-unpack-name-caches-the-buffer-tailroom-once-and-reuses-it)