Buffer Overflow Vulnerability in Zephyr Project's LwM2M Firmware Update Feature

CVE-2026-10672

What is CVE-2026-10672?

The vulnerability resides in the LwM2M firmware update mechanism of the Zephyr Project, where a fixed static buffer is utilized to copy external input without adequate length validation. This design flaw allows for the potential exploitation by a compromised management server or an on-path attacker, who could supply a URI longer than the intended buffer size. As a result, it can trigger an out-of-bounds read operation affecting adjacent memory, possibly leading to information disclosure about the device's internal state, or result in a denial of service. This vulnerability affects all versions starting from v3.0.0 up to v4.4.0 of the Zephyr Project.

References