# CVE-2026-126957: Zephyr ICMP integer underflow in IPv4 option handling

Source: https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126957 · Severity: medium · CVSS 5.3 · Published 2026-11-12

Zephyr is a real-time operating system used in IoT and embedded devices. An integer underflow flaw in its IPv4 network handling allows an attacker to send a malicious network packet that causes the device to leak sensitive stack memory—such as memory addresses and internal data—back to the attacker without requiring authentication. A single packet can trigger the leak, and the device remains operational, allowing repeated exploitation.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-126957 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126957 being exploited in the wild.

**How severe is CVE-2026-126957?** Medium severity, with a CVSS score of 5.3, published 12 November 2026.

**Which products and versions are affected?** Zephyr Project Zephyr RTOS <= 4.4.0.

**Is there a fix for CVE-2026-126957?** Yes: fixed in Main branch (as of PR 11273 merge on 2026-11-12); release versions not yet specified. Until then: Disable CONFIG_NET_IPV4_HDR_OPTIONS if IPv4 multicast (CONFIG_NET_IPV4_IGMP) is not required, or restrict ICMP Echo Request replies to trusted network sources using firewall rules. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126957 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-126957?** Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Main branch (as of PR 11273 merge on 2026-11-12); release versions not yet specified

Disable CONFIG_NET_IPV4_HDR_OPTIONS if IPv4 multicast (CONFIG_NET_IPV4_IGMP) is not required, or restrict ICMP Echo Request replies to trusted network sources using firewall rules.

## Technical details

An integer underflow in icmpv4_update_record_route() and icmpv4_update_time_stamp() (subsys/net/ip/icmpv4.c) computes a copy length using uint8_t arithmetic (ptr - ptr_offset) without enforcing the RFC 791 minimum pointer value, causing wraparound when ptr is smaller than ptr_offset (e.g., 0 - 4 = 252). The vulnerable functions then read up to 213 bytes past a 40-byte stack buffer (opt_data), leaking stack memory including pointers in ICMP Echo Replies. Attack requires a network-reachable Zephyr device with CONFIG_NET_IPV4_HDR_OPTIONS or CONFIG_NET_IPV4_IGMP enabled, responding to ICMP Echo Requests; no authentication is needed, and a fix is available in the main branch.

## Affected products

- Zephyr Project Zephyr RTOS <= 4.4.0

## Timeline

- 2026-11-12: disclosed
- 2026-11-12: patched: Fix merged to main branch (pull request 11273)

## References

- [https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cvv6-5f6x-87qf](https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cvv6-5f6x-87qf)

## Related threats

- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random)
- [Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter)
- [Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not)
- [Zephyr device multiplexer privilege escalation in devmux](https://junglewise.ai/threats/cve-2026-19947-the-device-multiplexer-pseudo-driver-in-drivers-misc-devmux)