Heap-based out-of-bounds write vulnerability in hawkBit device management client by Zephyr Project

CVE-2026-10849

What is CVE-2026-10849?

The hawkBit device management client in the Zephyr Project is susceptible to a heap-based out-of-bounds write due to a flaw in how it handles HTTP response bodies. The system fails to allocate sufficient space for a terminating NUL character, resulting in corrupting adjacent memory areas or allocator metadata. This vulnerability allows for remote exploitation through a malicious update server, leading to potential denial of service. The recent fix addresses this issue by ensuring proper buffer sizing and copying, thereby preventing the write from exceeding allocated memory bounds.

References