Memory Corruption Vulnerability in Zephyr Operating System by Vendor Zephyr Project

CVE-2026-12633

What is CVE-2026-12633?

The Zephyr Operating System has a vulnerability in its IPv6 neighbor-discovery functionality that can be exploited via malicious Router Advertisements. Specifically, the 6LoWPAN Context Option (6CO) processing in the code is flawed due to an unbounded context length field. Attackers, situated on the same local link, can send crafted packets that trigger an out-of-bounds memory zeroing operation, potentially leading to memory corruption and a denial of service condition. The flaw arises because the context length is not appropriately constrained to the RFC maximum during processing, enabling wide exploitation possibilities. This issue emphasizes the need for stringent validation of incoming data to prevent inadvertent memory manipulation.

References