# CVE-2026-10848: Zephyr OCPP 1.6 client buffer over-read in RPC frame parsing

Source: https://junglewise.ai/threats/cve-2026-10848-zephyr-ocpp-1-6-client-buffer-over-read-in-rpc-frame-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-10848 · Severity: high · CVSS 7 · Published 2026-08-02

The OCPP 1.6 client in Zephyr's networking library parses remote charging station commands sent over WebSocket. A malicious or compromised central station can send a specially crafted message that causes the client to read beyond allocated memory and potentially crash the device, leading to denial of service of the charging infrastructure integration.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-10848 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10848 being exploited in the wild.

**How severe is CVE-2026-10848?** High severity, with a CVSS score of 7, published 2 August 2026.

**Which products and versions are affected?** Zephyr RTOS <UNKNOWN>.

**Is there a fix for CVE-2026-10848?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10848 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-10848?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a buffer over-read in parse_rpc_msg() and extract_string_field() functions within ocpp_j.c, caused by unsafe use of strncpy() followed by strchr() without proper NUL-termination. The strncpy function does not NUL-terminate when the source is 127+ bytes, allowing strchr to scan past the 128-byte destination buffer into adjacent stack memory. A related defect in extract_payload() permits unbounded strchr/strrchr operations on a potentially unterminated receive buffer. The attack vector is network-based: inbound WAMP RPC frames arrive over WebSocket from the OCPP central system server (commonly unencrypted ws://). A malicious or on-path attacker can send an RPC frame with a uid or action field of 127+ bytes without a closing quote to trigger the over-read. The primary impact is denial of service via faulting on unmapped pages or stack corruption via stray NUL writes. The fix replaces the manual parser with bounds-respecting json_mixed_arr_parse() and explicitly NUL-terminates extracted fields.

## Affected products

- Zephyr RTOS <UNKNOWN>

## Timeline

- 2026-08-02: disclosed

## Related threats

- [Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack)
- [Zephyr RTOS PECI driver privilege escalation in peci_transfer()](https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy)
- [Zephyr Bluetooth host ATT buffer use-after-free in signed write path](https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does)
- [Zephyr Bluetooth Mesh Access layer delayable message context leak](https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in)
- [Zephyr TCP ISN derivation with all-zero key on entropy failure](https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net)