Network Stack Flaw in Zephyr Leads to Information Leak
CVE-2025-12899

6.5MEDIUM

Key Information:

Vendor

Zephyrproject-rtos

Status
Zephyr
Vendor
CVE Published:
30 January 2026

What is CVE-2025-12899?

A vulnerability in Zephyr's network stack misclassifies IPv4 packets with ICMP type 128 as ICMPv6 Echo Requests, leading to potential out-of-bounds memory reads. This flaw can create opportunities for information leakage within the networking subsystem, which may compromise the integrity of the system's data and pose security risks for users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Zephyr * <= 4.2

References

https://github.com/zephyrproject-rtos/zephyr/security/adv...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.