CVE-2026-19577: Zephyr RTOS IPv6 routing out-of-bounds read in neighbor resolution

CVE-2026-19577 · Severity: high · CVSS 7.1 · Published 2026-10-11

Zephyr RTOS, an embedded real-time operating system used in IoT and networked devices, fails to properly validate cached neighbor entries during IPv6 packet routing. An attacker on the same network can craft malicious packets to trigger an out-of-bounds memory read, causing the device to panic (denial of service) or potentially leak sensitive data from memory to the network. No authentication is required.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-19577 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19577 being exploited in the wild.
How severe is CVE-2026-19577?
High severity, with a CVSS score of 7.1, published 11 October 2026.
Which products and versions are affected?
Zephyr Project Zephyr RTOS.
Is there a fix for CVE-2026-19577?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19577 attacked?
It is attacked over the network or from the adjacent network, in an operating system.
Am I affected by CVE-2026-19577?
Check whether you run Zephyr Project Zephyr RTOS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c, which resolves nexthop link-layer addresses without checking whether the neighbor cache entry has a valid link-layer address index. When a neighbor entry is unresolved (idx == NET_NBR_LLADDR_UNKNOWN = 0xff), net_nbr_get_lladdr() returns a pointer 2.5 KB past the end of the neighbor address array instead of NULL. This out-of-bounds pointer is then dereferenced, reading from fixed memory locations. With CONFIG_ASSERT enabled, this triggers a panic (DoS); with assertions disabled, up to 8 bytes of adjacent memory may be leaked via the outgoing frame's destination address field.

Affected products

  • Zephyr Project Zephyr RTOS

Timeline

  • 2026-10-11: disclosed
  • 2026-10-11: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.