# CVE-2026-76788: Zephyr OSDP Control Panel stack buffer overflow in reply parser

Source: https://junglewise.ai/threats/cve-2026-76788-the-osdp-control-panel-reply-parser-cp-decode-response-in-subsys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-76788 · Severity: high · CVSS 8.8 · Published 2026-10-19

Zephyr's OSDP implementation includes a control panel that processes security data from card readers and keypad devices over RS-485. A malicious or compromised card reader can send a specially crafted reply with an oversized payload, causing a stack buffer overflow that crashes the access control system or potentially allows code execution.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-76788 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76788 being exploited in the wild.

**How severe is CVE-2026-76788?** High severity, with a CVSS score of 8.8, published 19 October 2026.

**Which products and versions are affected?** Zephyr RTOS versions with CONFIG_OSDP, CONFIG_OSDP_MODE_CP enabled.

**Is there a fix for CVE-2026-76788?** Yes: fixed in Versions incorporating the patch that adds OSDP_EVENT_MAX_DATALEN bound checks to REPLY_KEYPAD and REPLY_RAW handlers. Until then: Disable CONFIG_OSDP_MODE_CP if OSDP control panel functionality is not required. Enable CONFIG_OSDP_SC_ENABLED to require secure channel authentication and reject plaintext replies, though a single unauthenticated frame with invalid MAC will deactivate the secure channel. Restrict physical access to RS-485 wiring. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76788 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-76788?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Versions incorporating the patch that adds OSDP_EVENT_MAX_DATALEN bound checks to REPLY_KEYPAD and REPLY_RAW handlers

Disable CONFIG_OSDP_MODE_CP if OSDP control panel functionality is not required. Enable CONFIG_OSDP_SC_ENABLED to require secure channel authentication and reject plaintext replies, though a single unauthenticated frame with invalid MAC will deactivate the secure channel. Restrict physical access to RS-485 wiring.

## Technical details

The cp_decode_response() function in osdp_cp.c fails to validate payload length bounds for REPLY_KEYPAD and REPLY_RAW reply types before copying into fixed 64-byte stack buffers. An attacker on the RS-485 bus with knowledge of valid frame headers (SOM, CRC-16, sequence number) can send an oversized payload that overwrites stack memory including return addresses. No check ties the reply ID to the outstanding command, so any valid frame is accepted as a response to any command.

## Affected products

- Zephyr Zephyr RTOS versions with CONFIG_OSDP, CONFIG_OSDP_MODE_CP enabled

## Timeline

- 2026-10-19: disclosed

## Related threats

- [Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys)
- [Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread)
- [Zephyr HTTP/2 server NULL pointer dereference in stream binding](https://junglewise.ai/threats/cve-2026-87045-the-http-2-server-in-subsys-net-lib-http-http-server-http2-c)
- [Zephyr RTIO submission-queue verifier memory access bypass](https://junglewise.ai/threats/cve-2026-87041-the-rtio-submission-queue-verifier-rtio-vrfy-sqe-in-subsys-rtio)
- [Zephyr i3c_transfer TOCTOU privilege escalation](https://junglewise.ai/threats/cve-2026-87038-the-user-mode-verification-handler-for-the-i3c-transfer-system)