# CVE-2026-8718: Zephyr DTLS Connection ID buffer overflow in getsockopt

Source: https://junglewise.ai/threats/cve-2026-8718-zephyr-dtls-connection-id-buffer-overflow-in-getsockopt  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-8718 · Severity: high · CVSS 8.4 · Published 2026-08-10

Zephyr is an open-source real-time operating system (RTOS) used to power embedded devices and IoT applications. A buffer overflow vulnerability in its TLS socket handling can allow an unprivileged user or thread to crash the kernel or execute arbitrary code by supplying a small buffer when querying the peer's DTLS connection ID on an established encrypted connection.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-8718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8718 being exploited in the wild.

**How severe is CVE-2026-8718?** High severity, with a CVSS score of 8.4, published 10 August 2026.

**Which products and versions are affected?** Zephyr Project Zephyr RTOS v3.5.0 and later.

**Is there a fix for CVE-2026-8718?** A patch was published on 2026-08-10: Patch committed to main branch (commit aa317825a55a401315e8e17f620c70c02e8f176d) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8718 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-8718?** Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap buffer overflow in the tls_opt_dtls_peer_connection_id_value_get() function in subsys/net/lib/sockets/sockets_tls.c. When handling the getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE) syscall, the code passes a caller-supplied buffer directly to mbedtls_ssl_get_peer_cid() without validating that the buffer is at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes. The underlying mbedtls function unconditionally writes up to 31 bytes past a smaller buffer. In CONFIG_USERSPACE builds, the syscall verifier bounce-buffers the user's optval into a kernel heap allocation of exactly optlen bytes, making this exploitable by any unprivileged user thread with an established DTLS session where Connection ID negotiation is enabled. The vulnerability was introduced in v3.5.0 when the TLS_DTLS_CID option was added and requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID to be enabled. A patch validates that optlen is at least the required size and rejects smaller buffers with -EINVAL.

## Affected products

- Zephyr Project Zephyr RTOS v3.5.0 and later

## Timeline

- 2026-08-10: disclosed
- 2026-08-10: patched: Patch committed to main branch (commit aa317825a55a401315e8e17f620c70c02e8f176d)

## References

- [https://github.com/zephyrproject-rtos/zephyr](https://github.com/zephyrproject-rtos/zephyr)
- [https://github.com/zephyrproject-rtos/zephyr/commit/aa317825a55a401315e8e17f620c70c02e8f176d](https://github.com/zephyrproject-rtos/zephyr/commit/aa317825a55a401315e8e17f620c70c02e8f176d)

## Related threats

- [Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a)
- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random)
- [Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter)
- [Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not)