# CVE-2026-76787: Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsing

Source: https://junglewise.ai/threats/cve-2026-76787-the-updatehub-firmware-over-the-air-client-parses-the-coap-probe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-76787 · Severity: medium · CVSS 5.9 · Published 2026-10-19

Zephyr's UpdateHub firmware-over-the-air client is vulnerable to a denial-of-service attack when parsing CoAP firmware update probe responses from a server. An attacker on the network path, performing DNS spoofing, or winning a race with a forged UDP packet can crash the device by sending a malformed response, forcing a reboot and preventing legitimate firmware updates. This vulnerability affects embedded devices with Zephyr OS that automatically poll for updates.

Technologies: [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-76787 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76787 being exploited in the wild.

**How severe is CVE-2026-76787?** Medium severity, with a CVSS score of 5.9, published 19 October 2026.

**Which products and versions are affected?** Zephyr Project Zephyr OS all versions prior to fix.

**Is there a fix for CVE-2026-76787?** Yes: fixed in Zephyr OS (fix committed; version not specified in advisory). Until then: Set CONFIG_UPDATEHUB_DTLS=y to authenticate and encrypt CoAP server communication. Alternatively, disable CONFIG_UPDATEHUB_POLL_INTERVAL or set it to a very high value to reduce polling frequency and attack surface. Restrict network access to the UpdateHub server. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76787 attacked?** It is attacked over the network or from the adjacent network, in an operating system.

**Am I affected by CVE-2026-76787?** Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Zephyr OS (fix committed; version not specified in advisory)

Set CONFIG_UPDATEHUB_DTLS=y to authenticate and encrypt CoAP server communication. Alternatively, disable CONFIG_UPDATEHUB_POLL_INTERVAL or set it to a very high value to reduce polling frequency and attack surface. Restrict network access to the UpdateHub server.

## Technical details

The vulnerability is a NULL pointer dereference in z_impl_updatehub_probe() where the JSON parser treats the "sha256sum" field as optional and leaves it NULL if omitted from the CoAP response. The code then calls strlen() on this NULL pointer without validation, causing a read at address zero. With DTLS disabled (the default), the CoAP server is unauthenticated and unencrypted, allowing network-based attackers to inject malformed metadata. The impact is availability only; on systems with low-address protection or MMU, the fault triggers a fatal exception and system halt on each poll interval.

## Affected products

- Zephyr Project Zephyr OS all versions prior to fix

## Timeline

- 2026-10-19: disclosed

## Related threats

- [Zephyr MCTP over USB use-after-free in packet buffer handling](https://junglewise.ai/threats/cve-2026-85032-the-mctp-over-usb-device-class-in-subsys-pmci-mctp-mctp-usb-c)
- [Zephyr arm64 MMU TLB invalidation memory isolation bypass](https://junglewise.ai/threats/cve-2026-79979-the-arm64-mmu-backend-invalidates-a-single-virtual-address-from)
- [CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsing](https://junglewise.ai/threats/cve-2026-75084-the-cc1200-sub-ghz-ieee-802-15-4-driver-takes-the-phy-packet)
- [Zephyr Bluetooth Link Layer memory leak in connection update](https://junglewise.ai/threats/cve-2026-19739-the-bluetooth-link-layer-control-procedure-code-in-subsys)
- [Zephyr Project Bluetooth Link Layer Control Procedure memory leak in CIS creation](https://junglewise.ai/threats/cve-2026-19738-the-bluetooth-link-layer-control-procedure-llcp-implementation)