Firmware Update Agent Vulnerability in Zephyr Project by Lattice Semiconductor

CVE-2026-11810

What is CVE-2026-11810?

The Zephyr Project's firmware-update agent contains a vulnerability in its UpdateHub probe handler which processes JSON metadata from an update server. The handler fails to sufficiently validate inner object arrays before dereferencing pointers, potentially leading to a denial of service. An attacker can exploit this by presenting crafted metadata from a compromised update server, causing the device to halt or reset when dereferencing a NULL pointer. The vulnerability affects both 'any boards' and 'some boards' metadata layouts, but it does not result in memory corruption or information leakage. The proposed fix includes rejecting metadata with empty inner object arrays prior to dereference.

References