Out-of-bounds Read Vulnerability in Zephyr's 6LoWPAN IPHC Implementation

CVE-2026-12630

What is CVE-2026-12630?

An out-of-bounds read vulnerability exists in Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code. This flaw arises due to improper bounds checking during the processing of destination inline size, which allows an unauthenticated attacker to exploit crafted frames on the radio or adjacent link. By selecting an out-of-range index from the dispatch word, the vulnerability can unintentionally lead to corrupted data and denial-of-service conditions. Affected frames are processed without appropriate checks, resulting in potential memory leaks and malformed uncompression. Mitigation has been applied to reject invalid indexes and prevent further processing of malformed frames.

References