Is CVE-2026-19569 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19569 being exploited in the wild.

How severe is CVE-2026-19569?

High severity, with a CVSS score of 8.8, published 9 October 2026.

Which products and versions are affected?

Zephyr Project Zephyr all versions with CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled.

How is CVE-2026-19569 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-19569?

Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19569: Zephyr kernel integer overflow in dynamic object allocation

CVE-2026-19569 · Severity: high · CVSS 8.8 · Published 2026-10-09

Zephyr is a real-time operating system kernel used in embedded devices and IoT systems. An integer overflow vulnerability in dynamic memory allocation allows unprivileged user-mode code to corrupt kernel memory and achieve code execution at the kernel level, completely bypassing the userspace sandbox. This vulnerability requires specific kernel configuration options and affects systems relying on Zephyr's privilege separation for security.

Technologies: Zephyr Project Zephyr. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-19569 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19569 being exploited in the wild.
How severe is CVE-2026-19569?: High severity, with a CVSS score of 8.8, published 9 October 2026.
Which products and versions are affected?: Zephyr Project Zephyr all versions with CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled.
Is there a fix for CVE-2026-19569?: No fixed version is recorded yet. Disable CONFIG_DYNAMIC_OBJECTS or CONFIG_USERSPACE if the dynamic object allocation feature is not required, or restrict assignment of resource pools to only trusted threads. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19569 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-19569?: Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable CONFIG_DYNAMIC_OBJECTS or CONFIG_USERSPACE if the dynamic object allocation feature is not required, or restrict assignment of resource pools to only trusted threads.

Technical details

The dynamic_object_create() function in kernel/userspace/userspace.c fails to check for unsigned integer wrap-around when computing backing heap allocations for dynamically created kernel objects. An attacker in user mode can supply a size argument close to SIZE_MAX to the k_object_alloc_size() or k_thread_stack_alloc() syscalls, causing the size computation to wrap to a very small value. The resulting undersized heap chunk is then used by subsequent init syscalls (k_mutex_init, k_sem_init, k_thread_create, etc.) which write a full-sized object structure into the truncated allocation, corrupting adjacent kernel heap metadata and objects.

Affected products

Zephyr Project Zephyr all versions with CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.