Is CVE-2026-87044 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87044 being exploited in the wild.

How severe is CVE-2026-87044?

Medium severity, with a CVSS score of 6.5, published 4 November 2026.

Which products and versions are affected?

Zephyr OS versions prior to fix for CVE-2026-87044.

How is CVE-2026-87044 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-87044?

Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87044: Mbed TLS crypto shim driver heap exhaustion via unaborted PSA operations

CVE-2026-87044 · Severity: medium · CVSS 6.5 · Published 2026-11-04

The Mbed TLS crypto shim driver in Zephyr OS leaks cryptographic operation contexts when cipher or AEAD operations fail, exhausting the fixed 512-byte heap after just a few failed operations. An attacker can trigger these failures by sending malformed IEEE 802.15.4 frames or OSDP messages within radio range, causing all subsequent cryptographic operations to fail and permanently disabling network security until the device reboots.

Technologies: Zephyr OS. Vendors: Zephyr.

Quick answers

Is CVE-2026-87044 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87044 being exploited in the wild.
How severe is CVE-2026-87044?: Medium severity, with a CVSS score of 6.5, published 4 November 2026.
Which products and versions are affected?: Zephyr OS versions prior to fix for CVE-2026-87044.
Is there a fix for CVE-2026-87044?: No fixed version is recorded yet. Disable IEEE 802.15.4 link-layer security (CONFIG_NET_L2_IEEE802154_SECURITY) or OSDP secure channel (CONFIG_OSDP_SC_ENABLED) if not required; restrict radio-range access to trusted devices to prevent transmission of malformed frames. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87044 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-87044?: Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable IEEE 802.15.4 link-layer security (CONFIG_NET_L2_IEEE802154_SECURITY) or OSDP secure channel (CONFIG_OSDP_SC_ENABLED) if not required; restrict radio-range access to trusted devices to prevent transmission of malformed frames.

Technical details

The vulnerability is a resource leak in mbedtls_cbc() and mbedtls_aead() where error paths after successful PSA cipher/AEAD setup omit the required psa_cipher_abort() or psa_aead_abort() call, leaking ~288-byte mbedtls_aes_context objects or finite secure-partition operation slots. An unauthenticated attacker on the network (IEEE 802.15.4) or OSDP channel can trigger failures in psa_aead_verify() or psa_cipher_update() by sending frames with invalid message integrity codes, exhausting the heap and breaking all cryptographic operations until device reboot.

Affected products

Zephyr OS versions prior to fix for CVE-2026-87044

Timeline

2026-11-04: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.