# CVE-2026-19186: Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption

Source: https://junglewise.ai/threats/cve-2026-19186-ieee802154-decipher-data-frame-in-subsys-net-l2-ieee802154  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-19186 · Severity: high · CVSS 8.1 · Published 2026-10-07

Zephyr RTOS's IEEE 802.15.4 network stack contains an integer underflow bug in the frame decryption path when security is enabled. An attacker within radio range can send a specially crafted short wireless frame to trigger an out-of-bounds memory read and write, corrupting adjacent network buffers and causing the device to crash. No authentication or prior key exchange is required.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19186 being exploited in the wild.

**How severe is CVE-2026-19186?** High severity, with a CVSS score of 8.1, published 7 October 2026.

**Which products and versions are affected?** Zephyr RTOS versions with CONFIG_NET_L2_IEEE802154_SECURITY enabled.

**Is there a fix for CVE-2026-19186?** Yes: fixed in Zephyr RTOS (fix adds length validation in ieee802154_decipher_data_frame() and ieee802154_create_data_frame()). Until then: Disable CONFIG_NET_L2_IEEE802154_SECURITY or set all IEEE 802.15.4 security sessions to IEEE802154_SECURITY_LEVEL_NONE until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19186 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-19186?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Zephyr RTOS (fix adds length validation in ieee802154_decipher_data_frame() and ieee802154_create_data_frame())

Disable CONFIG_NET_L2_IEEE802154_SECURITY or set all IEEE 802.15.4 security sessions to IEEE802154_SECURITY_LEVEL_NONE until patching is possible.

## Technical details

The ieee802154_decipher_data_frame() function subtracts header and authentication tag lengths from the received frame length using uint8_t arithmetic without first validating the frame is long enough, causing integer underflow when the payload is shorter than the authentication tag. The resulting large wrapped length is passed to the CCM decryption operation, reading and writing several hundred bytes beyond the packet buffer into adjacent memory. Exploitation requires CONFIG_NET_L2_IEEE802154_SECURITY enabled with a crypto device configured and an active security session with non-NONE security level.

## Affected products

- Zephyr RTOS versions with CONFIG_NET_L2_IEEE802154_SECURITY enabled

## Timeline

- 2026-10-07: disclosed

## Related threats

- [Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack)
- [Zephyr RTOS PECI driver privilege escalation in peci_transfer()](https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy)
- [Zephyr Bluetooth host ATT buffer use-after-free in signed write path](https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does)
- [Zephyr Bluetooth Mesh Access layer delayable message context leak](https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in)
- [Zephyr TCP ISN derivation with all-zero key on entropy failure](https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net)