Buffer Overflow Vulnerability in Zephyr Settings Subsystem by Zephyr Project

CVE-2026-12634

What is CVE-2026-12634?

The Zephyr settings subsystem features a vulnerability where an attacker can exploit an out-of-bounds write in the NVS backend. This occurs due to improper handling of stored setting-name entries, allowing a malicious actor to cause a crash or denial of service by writing beyond an allocated stack buffer. The flaw arises when input values exceed the expected buffer size, potentially leading to limited stack corruption. It's crucial to note that exploitation requires either direct access to the flash memory or the presence of untrusted components, as malicious entries cannot be crafted through the standard settings API.

References