Executive brief
Zephyr's LwM2M JSON parser contains a one-byte buffer overflow in the get_string() function that can be exploited by a malicious LwM2M server. When writing a string resource over CoAP/DTLS, an attacker can send a string exactly matching the target buffer size, causing a NUL-terminator to be written beyond the buffer boundary. While limited to a single zero byte, this can corrupt adjacent memory structures, leading to data loss or application crashes.
Technical details
The vulnerability is a classic off-by-one buffer overflow (CWE-787) in subsys/net/lib/lwm2m/lwm2m_rw_json.c. The get_string() function uses an insufficient length guard (if (string_length > buflen)) that permits a string whose length equals buflen, then writes a NUL terminator at buf[string_length], one byte past the buffer end. The attacker-controlled string value and length are extracted directly from the incoming LwM2M WRITE CoAP payload via do_write_op_json() and passed to lwm2m_write_handler(). The destination buffer is either a resource instance's fixed data buffer or the engine validation buffer. The overflow writes a single constant 0x00 byte to adjacent memory, potentially corrupting resource metadata, length fields, or other struct members. The fix changes the guard to string_length >= buflen, aligning with other formatters already deployed in the codebase.
Affected products
- Zephyr Zephyr RTOS versions with LwM2M support prior to the fix
Timeline
- 2026-08-31: disclosed
- other: CVE-2026-14368 assigned