# CVE-2026-1679: The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space…

Source: https://junglewise.ai/threats/cve-2026-1679-the-eswifi-socket-offload-driver-copies-user-provided-payloads  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-28  
License: CC BY 4.0 with a link back

CVE-2026-1679 · Severity: high · CVSS 7.3 · Published 2026-03-28

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, corrupting kernel memory (CWE-120). Exploit requires local code that can call the socket send API; no remote attacker can reach it directly.

Technologies: [Zephyrproject Zephyr](https://junglewise.ai/threats/technologies/zephyrproject-zephyr). Vendors: [Zephyrproject](https://junglewise.ai/threats/vendors/zephyrproject).

## Quick answers

**Is CVE-2026-1679 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1679 being exploited in the wild.

**How severe is CVE-2026-1679?** High severity, with a CVSS score of 7.3, published 28 March 2026.

**Which products and versions are affected?** Zephyrproject Zephyr. The advisory does not name versions.

**Is there a fix for CVE-2026-1679?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-1679?** Check whether you run Zephyrproject Zephyr. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Zephyrproject Zephyr

## Related threats

- [The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning…](https://junglewise.ai/threats/cve-2026-11368-the-bluetooth-host-att-layer-subsys-bluetooth-host-att-c)
- [The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update…](https://junglewise.ai/threats/cve-2026-10849-the-hawkbit-device-management-client-in-subsys-mgmt-hawkbit)
- [Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration…](https://junglewise.ai/threats/cve-2026-2411-zephyr-s-bluetooth-host-declares-a-gatt-characteristic-as-two)
- [The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const…](https://junglewise.ai/threats/cve-2026-10773-the-dhcpv4-client-helper-net-dhcpv4-msg-type-name-in-subsys-net)
- [dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the…](https://junglewise.ai/threats/cve-2026-1678-dns-unpack-name-caches-the-buffer-tailroom-once-and-reuses-it)