Memory Fault Vulnerability in LwM2M Message Handling of Zephyr RTOS

CVE-2026-18746

What is CVE-2026-18746?

The Zephyr RTOS contains a vulnerability in the LwM2M message handling subsystem that can lead to fatal memory faults due to improper handling of CoAP WRITE/CREATE requests. The issue arises when the system attempts to handle block-wise writes, which can allow an attacker to exploit unguarded dereferences, resulting in device crashes or resets. In NoSec deployments, an attacker can execute this sequence without needing any credentials, potentially leading to denial-of-service conditions. A fix has been implemented that secures context pointers before memory access, mitigating the risk of such faults.

References