Network Stack Flaw in Zephyr Leads to Information Leak
CVE-2025-12899

6.5MEDIUM

Key Information:

Vendor

Zephyrproject-rtos

Status
Zephyr
Vendor
CVE Published:
30 January 2026

What is CVE-2025-12899?

A vulnerability in Zephyr's network stack misclassifies IPv4 packets with ICMP type 128 as ICMPv6 Echo Requests, leading to potential out-of-bounds memory reads. This flaw can create opportunities for information leakage within the networking subsystem, which may compromise the integrity of the system's data and pose security risks for users.

Affected Version(s)

Zephyr * <= 4.2

References

https://github.com/zephyrproject-rtos/zephyr/security/adv...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.