Is CVE-2026-15892 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15892 being exploited in the wild.

How severe is CVE-2026-15892?

Medium severity, with a CVSS score of 5.3, published 13 September 2026.

Which products and versions are affected?

Nordic Semiconductor NCS mcumgr affected versions prior to patch.

Is there a fix for CVE-2026-15892?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15892 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15892?

Check whether you run Nordic Semiconductor NCS mcumgr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15892: NCS mcumgr SMP settings-management heap leak in settings handlers

CVE-2026-15892 · Severity: medium · CVSS 5.3 · Published 2026-09-13

The mcumgr SMP settings-management group is a management interface used to configure device settings over wireless connections like Bluetooth LE or UART. When configured to use heap memory and an access control hook, rejected setting requests cause heap memory to leak without being freed. An attacker can repeatedly send denied requests to exhaust available memory, causing the device to become unable to process further management commands and potentially affecting other system functionality.

Vendors: Nordic Semiconductor.

Quick answers

Is CVE-2026-15892 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15892 being exploited in the wild.
How severe is CVE-2026-15892?: Medium severity, with a CVSS score of 5.3, published 13 September 2026.
Which products and versions are affected?: Nordic Semiconductor NCS mcumgr affected versions prior to patch.
Is there a fix for CVE-2026-15892?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15892 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15892?: Check whether you run Nordic Semiconductor NCS mcumgr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a memory leak in the settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() handler functions in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c. When CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP is enabled, buffers are allocated via k_malloc() but only freed at an end: label. When CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK is also enabled and the application's access hook rejects a request by returning MGMT_CB_ERROR_RC, the handler calls return ret_rc directly without reaching the end: label, bypassing k_free() and leaking the heap allocation. The handlers are reachable over unauthenticated SMP transports (Bluetooth LE, UART, UDP depending on configuration). An attacker sending repeated rejected read/write/delete commands can monotonically exhaust the kernel heap, causing denial of service for mcumgr and other heap consumers. Only devices with both heap buffer type enabled and an access hook configured are affected; the default stack buffer type is not vulnerable.

Affected products

Nordic Semiconductor NCS mcumgr affected versions prior to patch

Timeline

2026-09-13: disclosed: CVE-2026-15892 disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.