CVE-2026-12364: Zephyr OS logging system-call validation bypass

CVE-2026-12364 · Severity: high · CVSS 8.4 · Published 2026-08-14

A logging system in Zephyr OS, used in embedded and IoT devices, fails to validate arguments passed from user-mode applications to the kernel. An attacker can trigger the kernel to read from arbitrary memory addresses and leak sensitive kernel data, or cause the kernel to crash. This bypasses the security boundary between user-mode and kernel-mode isolation.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-12364 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12364 being exploited in the wild.
How severe is CVE-2026-12364?
High severity, with a CVSS score of 8.4, published 14 August 2026.
Which products and versions are affected?
Zephyr Project Zephyr OS unknown.
Is there a fix for CVE-2026-12364?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12364 attacked?
It is attacked over the network or with local access, in an operating system.
Am I affected by CVE-2026-12364?
Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing kernel parameter validation in the z_vrfy_z_log_msg_static_create() system-call verifier (subsys/logging/log_msg.c). The verifier acts as a pure pass-through without performing K_SYSCALL_* validation checks, allowing unprivileged user-mode threads to invoke z_log_msg_static_create() with fully attacker-controlled arguments. The kernel-mode handler then dereferences these untrusted pointers—reading from memory via source, package, and data arguments—without bounds checking. An attacker can supply arbitrary kernel addresses and lengths to leak kernel memory or trigger a kernel panic. The fix adds K_SYSCALL_MEMORY_READ() validation and bounds checks against Z_LOG_MSG_MAX_PACKAGE. No memory corruption or write primitive is possible.

Affected products

  • Zephyr Project Zephyr OS unknown

Timeline

  • 2026-08-14: disclosed
  • 2026-08-14: advisory: CVE-2026-12364

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.