# CVE-2026-82962: Zephyr ethernet_fill_header() out-of-bounds write via routing

Source: https://junglewise.ai/threats/cve-2026-82962-ethernet-fill-header-in-subsys-net-l2-ethernet-ethernet-c-can  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-82962 · Severity: medium · CVSS 6.5 · Published 2026-10-28

Zephyr is a real-time operating system used in embedded IoT and networking devices. A flaw in Ethernet packet header handling can cause memory corruption when packets are routed or tunneled between network interfaces. Remote attackers on adjacent networks can trigger this condition simply by sending traffic through the device, potentially causing crashes or unpredictable system behavior.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-82962 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82962 being exploited in the wild.

**How severe is CVE-2026-82962?** Medium severity, with a CVSS score of 6.5, published 28 October 2026.

**Which products and versions are affected?** Zephyr RTOS versions prior to the fix.

**Is there a fix for CVE-2026-82962?** Yes: fixed in Zephyr versions with the fix applied (advisory does not specify exact version numbers). Until then: Disable CONFIG_NET_IPV4_FORWARDING and CONFIG_NET_IPV6_FORWARDING if inter-interface routing is not required. Alternatively, ensure CONFIG_ASSERT or CONFIG_NET_BUF_HARDENING are enabled to catch the condition before memory corruption occurs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82962 attacked?** It is attacked over the network or from the adjacent network, in an operating system.

**Am I affected by CVE-2026-82962?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Zephyr versions with the fix applied (advisory does not specify exact version numbers)

Disable CONFIG_NET_IPV4_FORWARDING and CONFIG_NET_IPV6_FORWARDING if inter-interface routing is not required. Alternatively, ensure CONFIG_ASSERT or CONFIG_NET_BUF_HARDENING are enabled to catch the condition before memory corruption occurs.

## Technical details

The ethernet_fill_header() function in Zephyr's Ethernet L2 subsystem attempts to prepend Ethernet headers in-place by pushing data into packet buffer headroom without verifying sufficient headroom exists. Packets forwarded from non-Ethernet interfaces (e.g., Wi-Fi, 802.15.4, PPP) lack the expected headroom reservation, allowing attackers on the network to trigger out-of-bounds writes that corrupt adjacent buffer memory or heap metadata. The vulnerability requires CONFIG_NET_IPV4_FORWARDING or CONFIG_NET_IPV6_FORWARDING enabled, and manifests as memory corruption rather than controlled code execution.

## Affected products

- Zephyr Zephyr RTOS versions prior to the fix

## Timeline

- 2026-10-28: disclosed

## Related threats

- [Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys)
- [Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread)
- [Zephyr HTTP/2 server NULL pointer dereference in stream binding](https://junglewise.ai/threats/cve-2026-87045-the-http-2-server-in-subsys-net-lib-http-http-server-http2-c)
- [Zephyr RTIO submission-queue verifier memory access bypass](https://junglewise.ai/threats/cve-2026-87041-the-rtio-submission-queue-verifier-rtio-vrfy-sqe-in-subsys-rtio)
- [Zephyr i3c_transfer TOCTOU privilege escalation](https://junglewise.ai/threats/cve-2026-87038-the-user-mode-verification-handler-for-the-i3c-transfer-system)