Out-of-Bounds Read Vulnerability in UpdateHub OTA Client by Zephyr Project

CVE-2026-11809

What is CVE-2026-11809?

The UpdateHub OTA client in the Zephyr Project has a vulnerability that could lead to an out-of-bounds read due to an uninitialized memory access. An improperly handled probe response from the UpdateHub server allows for crafted payloads that can result in denial of service. When the probe response, which is intended to be copied into a NUL-terminated buffer, is mishandled, the program may attempt to read beyond allocated memory, potentially causing application crashes or device failures. This vulnerability highlights the importance of proper memory initialization and validation in software applications.

References