Quick answers
- Is CVE-2026-19673 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19673 being exploited in the wild.
- How severe is CVE-2026-19673?
- High severity, with a CVSS score of 7.1, published 14 October 2026.
- Which products and versions are affected?
- Zephyr Project Zephyr RTOS Versions with CONFIG_NET_VLAN enabled and ETHERNET_HW_VLAN_TAG_STRIP disabled.
- Is there a fix for CVE-2026-19673?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-19673 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-19673?
- Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in ethernet_recv() where VLAN-tagged frames (ethertype 0x8100) trigger reinterpretation of a 14-byte buffer as an 18-byte structure without re-validating length. This causes a uint16_t underflow in the buffer length to 65534, allowing out-of-bounds reads and writes. An unauthenticated attacker on the network can send a 14–17 byte broadcast frame with VLAN ethertype to trigger the flaw; no prior knowledge of VLAN configuration is needed.
Affected products
- Zephyr Project Zephyr RTOS Versions with CONFIG_NET_VLAN enabled and ETHERNET_HW_VLAN_TAG_STRIP disabled
Timeline
- 2026-10-14: disclosed