Stack Overflow Vulnerability in OCPP 1.6 Client by Zephyr Project

CVE-2026-10848

What is CVE-2026-10848?

The OCPP 1.6 client in the Zephyr Project has a vulnerability due to improper handling of inbound WAMP RPC frames. The parsing function, extract_string_field(), fails to ensure proper NUL termination of copied buffers, which can lead to stack memory corruption and a remotely triggerable denial of service. This vulnerability is especially critical in configurations where the feature is enabled, exposing systems to risks from malicious central servers or attackers intercepting traffic over websockets. A patch has been released that addresses these memory handling issues, replacing the manual parsing logic with a safer, bounds-respecting function.

References