CVE-2026-10848: Zephyr OCPP 1.6 client buffer over-read in RPC frame parsing

CVE-2026-10848 · Severity: high · CVSS 7 · Published 2026-08-02

The OCPP 1.6 client in Zephyr's networking library parses remote charging station commands sent over WebSocket. A malicious or compromised central station can send a specially crafted message that causes the client to read beyond allocated memory and potentially crash the device, leading to denial of service of the charging infrastructure integration.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-10848 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10848 being exploited in the wild.
How severe is CVE-2026-10848?
High severity, with a CVSS score of 7, published 2 August 2026.
Which products and versions are affected?
Zephyr RTOS <UNKNOWN>.
Is there a fix for CVE-2026-10848?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10848 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-10848?
Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a buffer over-read in parse_rpc_msg() and extract_string_field() functions within ocpp_j.c, caused by unsafe use of strncpy() followed by strchr() without proper NUL-termination. The strncpy function does not NUL-terminate when the source is 127+ bytes, allowing strchr to scan past the 128-byte destination buffer into adjacent stack memory. A related defect in extract_payload() permits unbounded strchr/strrchr operations on a potentially unterminated receive buffer. The attack vector is network-based: inbound WAMP RPC frames arrive over WebSocket from the OCPP central system server (commonly unencrypted ws://). A malicious or on-path attacker can send an RPC frame with a uid or action field of 127+ bytes without a closing quote to trigger the over-read. The primary impact is denial of service via faulting on unmapped pages or stack corruption via stray NUL writes. The fix replaces the manual parser with bounds-respecting json_mixed_arr_parse() and explicitly NUL-terminates extracted fields.

Affected products

  • Zephyr RTOS <UNKNOWN>

Timeline

  • 2026-08-02: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.