# CVE-2026-87043: Zephyr entropy-device uninitialized read in random number generation

Source: https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-87043 · Severity: medium · CVSS 4.8 · Published 2026-11-04

A flaw in the Zephyr RTOS random number generator causes it to return uninitialized memory instead of random values when the entropy device is not yet ready. This affects security-sensitive operations like TCP sequence numbers, cryptographic tokens, and session keys, exposing stale memory contents and making network protocols predictable. An attacker can remotely observe and exploit these degraded random values without directly triggering the failure condition.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-87043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87043 being exploited in the wild.

**How severe is CVE-2026-87043?** Medium severity, with a CVSS score of 4.8, published 4 November 2026.

**Which products and versions are affected?** Zephyr Project Zephyr RTOS.

**Is there a fix for CVE-2026-87043?** No fixed version is recorded yet. Ensure entropy drivers initialize successfully and are ready before any kernel subsystem requires random values; systems can add explicit timer-based fallback paths in early-initialization code paths, similar to the existing z_early_rand_get() mechanism in kernel/init.c. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87043 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-87043?** Check whether you run Zephyr Project Zephyr RTOS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Ensure entropy drivers initialize successfully and are ready before any kernel subsystem requires random values; systems can add explicit timer-based fallback paths in early-initialization code paths, similar to the existing z_early_rand_get() mechanism in kernel/init.c.

## Technical details

The entropy_device driver in subsys/random/random_entropy_device.c returns -ENODEV without writing to the caller's output buffer when device_is_ready() fails. Since sys_rand_get() is declared void and discards the error, callers receive uninitialized stack or heap memory as random data. The normal not-ready state occurs during early boot before entropy drivers initialize (PRE_KERNEL_1 priority 50, after kernel objects at priority 30), and also when entropy driver initialization fails on real hardware. This leaves non-cryptographic random values as constants or stale memory, compromising TCP ISNs, CoAP tokens, DHCPv4/v6 transaction IDs, and other protocol-level randomization.

## Affected products

- Zephyr Project Zephyr RTOS

## Timeline

- 2026-11-04: disclosed

## Related threats

- [Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a)
- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter)
- [Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not)
- [Zephyr device multiplexer privilege escalation in devmux](https://junglewise.ai/threats/cve-2026-19947-the-device-multiplexer-pseudo-driver-in-drivers-misc-devmux)