Is CVE-2026-13214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13214 being exploited in the wild.

How severe is CVE-2026-13214?

Critical severity, with a CVSS score of 9.8, published 25 August 2026.

Is there a fix for CVE-2026-13214?

A patch was published on 2026-08-25: Fix committed as afbf880b04188ae53451a0ade4ac62b654fdff34 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13214 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-13214?

Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13214: Zephyr OCPP client stack buffer overflow in GetConfiguration handler

CVE-2026-13214 · Severity: critical · CVSS 9.8 · Published 2026-08-25

Zephyr RTOS contains a stack buffer overflow in its OCPP 1.6 (charging protocol) client implementation. An attacker controlling or intercepting communication between a charge point and its central system can send a malicious message that crashes the device or potentially executes arbitrary code on the RTOS kernel, affecting EV charging infrastructure availability and security.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-13214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13214 being exploited in the wild.
How severe is CVE-2026-13214?: Critical severity, with a CVSS score of 9.8, published 25 August 2026.
Which products and versions are affected?: Zephyr Project Zephyr RTOS <UNKNOWN>.
Is there a fix for CVE-2026-13214?: A patch was published on 2026-08-25: Fix committed as afbf880b04188ae53451a0ade4ac62b654fdff34 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13214 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-13214?: Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic stack buffer overflow (CWE-674) in parse_getconfig_msg() within subsys/net/lib/ocpp/ocpp_j.c. The handler uses unbounded strcpy() to copy a JSON "key" field from an OCPP GetConfiguration message into a fixed 50-byte stack buffer (skey[CISTR50]). The attacker-controlled key value is bounded only by the WebSocket receive buffer size (default 2048 bytes), allowing overflow. The message is delivered over a WebSocket connection initiated by the charge point to a configured central system; an attacker who controls that endpoint or performs MITM on unencrypted connections can trigger the overflow. The impact ranges from denial of service (reader thread crash) to remote code execution depending on stack protections (canaries, MPU). The fix replaces strcpy() with bounded strncpy(key, payload.key[0], CISTR50 - 1) followed by explicit NUL termination.

Affected products

Zephyr Project Zephyr RTOS <UNKNOWN>

Timeline

2026-08-25: disclosed
2026-08-25: patched: Fix committed as afbf880b04188ae53451a0ade4ac62b654fdff34

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.