Integer Underflow Vulnerability in Zephyr’s ICMPv4 Handling

CVE-2026-126957

What is CVE-2026-126957?

An integer underflow in Zephyr's handling of IPv4 options permits remote, unauthenticated attackers to exploit certain ICMP Echo Requests. This vulnerability arises from improper validation of the Pointer field in ICMPv4 options, enabling an attacker to manipulate option lengths and effectively read beyond allocated memory. The resulting data leak could expose sensitive information, such as stack and heap pointers, without crashing the affected devices. Devices configured with specific IPv4 header options are particularly susceptible, allowing for repeated exploitation through a single malicious packet.

References