JSON Buffer Overflow in LwM2M Formatter by Zephyr Project

CVE-2026-14368

What is CVE-2026-14368?

A vulnerability exists in the LwM2M JSON content formatter of the Zephyr Project, where improper length checks in the get_string() function can lead to a buffer overflow. When processing CoAP payloads during a WRITE operation, if the incoming JSON string length matches the destination buffer size, it results in an out-of-bounds write, potentially corrupting adjacent memory. Although this overflow does not directly lead to code execution, it can cause significant data corruption or crashes by altering adjacent resources or fields within memory structures. The fix improves the length guard to prevent exact matches with buffer sizes, enhancing the security of the JSON formatter.

References