Is CVE-2026-19186 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19186 being exploited in the wild.

How severe is CVE-2026-19186?

High severity, with a CVSS score of 8.1, published 7 October 2026.

Which products and versions are affected?

Zephyr RTOS versions with CONFIG_NET_L2_IEEE802154_SECURITY enabled.

How is CVE-2026-19186 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-19186?

Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19186: Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption

CVE-2026-19186 · Severity: high · CVSS 8.1 · Published 2026-10-07

Zephyr RTOS's IEEE 802.15.4 network stack contains an integer underflow bug in the frame decryption path when security is enabled. An attacker within radio range can send a specially crafted short wireless frame to trigger an out-of-bounds memory read and write, corrupting adjacent network buffers and causing the device to crash. No authentication or prior key exchange is required.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-19186 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19186 being exploited in the wild.
How severe is CVE-2026-19186?: High severity, with a CVSS score of 8.1, published 7 October 2026.
Which products and versions are affected?: Zephyr RTOS versions with CONFIG_NET_L2_IEEE802154_SECURITY enabled.
Is there a fix for CVE-2026-19186?: Yes: fixed in Zephyr RTOS (fix adds length validation in ieee802154_decipher_data_frame() and ieee802154_create_data_frame()). Until then: Disable CONFIG_NET_L2_IEEE802154_SECURITY or set all IEEE 802.15.4 security sessions to IEEE802154_SECURITY_LEVEL_NONE until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19186 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-19186?: Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Zephyr RTOS (fix adds length validation in ieee802154_decipher_data_frame() and ieee802154_create_data_frame())

Disable CONFIG_NET_L2_IEEE802154_SECURITY or set all IEEE 802.15.4 security sessions to IEEE802154_SECURITY_LEVEL_NONE until patching is possible.

Technical details

The ieee802154_decipher_data_frame() function subtracts header and authentication tag lengths from the received frame length using uint8_t arithmetic without first validating the frame is long enough, causing integer underflow when the payload is shorter than the authentication tag. The resulting large wrapped length is passed to the CCM decryption operation, reading and writing several hundred bytes beyond the packet buffer into adjacent memory. Exploitation requires CONFIG_NET_L2_IEEE802154_SECURITY enabled with a crypto device configured and an active security session with non-NONE security level.

Affected products

Zephyr RTOS versions with CONFIG_NET_L2_IEEE802154_SECURITY enabled

Timeline

2026-10-07: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.