CVE-2026-18746: Zephyr LwM2M parse_write_op null pointer dereference in block handling

CVE-2026-18746 · Severity: medium · CVSS 5.9 · Published 2026-09-29

Zephyr's lightweight M2M (LwM2M) implementation contains a null pointer dereference in CoAP block transfer handling that allows an unauthenticated attacker on the network to crash or reset an LwM2M client device. By initiating multiple incomplete block-wise write operations, an attacker can exhaust the fixed pool of transfer contexts and trigger a crash when processing the fourth concurrent transfer. In deployments without DTLS security, this requires only network access to the device's UDP socket.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-18746 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18746 being exploited in the wild.
How severe is CVE-2026-18746?
Medium severity, with a CVSS score of 5.9, published 29 September 2026.
Which products and versions are affected?
Zephyr Project Zephyr RTOS All versions with LwM2M block transfer support.
Is there a fix for CVE-2026-18746?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18746 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-18746?
Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The parse_write_op() function in lwm2m_message_handling.c fails to validate the return code of init_block_ctx() before dereferencing the returned context pointer. When the block context pool is exhausted, init_block_ctx() returns -ENOMEM with the context pointer set to NULL, but the subsequent assignment block_ctx->ctx.block_size = block_size proceeds unconditionally, causing a null pointer dereference. The attack requires an attacker with network access to the LwM2M socket (reachable from any peer in NoSec mode or from bootstrap/lower-trust servers) and works by exhausting the three-entry static pool with incomplete transfers before sending a fourth write request.

Affected products

  • Zephyr Project Zephyr RTOS All versions with LwM2M block transfer support

Timeline

  • 2026-09-29: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.