# CVE-2026-18747: Zephyr MCUmgr SMP-over-console buffer underflow and out-of-bounds read

Source: https://junglewise.ai/threats/cve-2026-18747-the-mcumgr-smp-over-console-transport-decodes-a-base64-frame  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-18747 · Severity: medium · CVSS 6.8 · Published 2026-09-29

Zephyr's MCUmgr management interface processes configuration and system commands over a serial console. An attacker with write access to that console can send a malformed 7-byte packet that causes an integer underflow, inflating the declared payload size to 65 KB while the actual buffer is only 384 bytes. This allows reading arbitrary memory from the MCUmgr thread, causing either denial of service or leaking sensitive data like system configuration.

Vendors: [Nordic Semiconductor](https://junglewise.ai/threats/vendors/nordic-semiconductor).

## Quick answers

**Is CVE-2026-18747 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18747 being exploited in the wild.

**How severe is CVE-2026-18747?** Medium severity, with a CVSS score of 6.8, published 29 September 2026.

**Which products and versions are affected?** Nordic Semiconductor Zephyr all versions prior to fix.

**Is there a fix for CVE-2026-18747?** A patch was published on 2026-09-29: Fix rejects declared packet lengths ≤2 bytes in mcumgr_serial_extract_len() Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18747 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-18747?** Check whether you run Nordic Semiconductor Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an integer underflow in mcumgr_serial_extract_len() and mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c. A crafted base64-encoded SMP frame with declared length ≤2 bytes bypasses CRC validation (since CRC over zero bytes returns the seed); the subsequent len -= 2U subtraction underflows the uint16_t length field to approximately 65 KB, and the inflated bounds are passed to the CBOR parser. An unauthenticated attacker can craft prior frames to stage buffer contents, then trigger an out-of-bounds read via net_buf_pull() that moves the parse cursor into adjacent memory, enabling memory disclosure or thread fault.

## Affected products

- Nordic Semiconductor Zephyr all versions prior to fix

## Timeline

- 2026-09-29: disclosed: CVE-2026-18747 published
- 2026-09-29: patched: Fix rejects declared packet lengths ≤2 bytes in mcumgr_serial_extract_len()