Buffer Underflow Vulnerability in MCUmgr Transport Affects Zephyr Project Firmware

CVE-2026-18747

What is CVE-2026-18747?

The MCUmgr transport in the Zephyr Project is vulnerable to a buffer underflow issue, allowing an attacker to exploit unauthenticated access via the management console. When a specifically crafted base64-encoded packet is sent, it can lead to a severe underflow condition and allow the attacker to read beyond allowed memory boundaries, resulting in potential memory disclosure or denial-of-service scenarios. The vulnerability arises from improper handling of declared packet lengths and can be triggered without the need for prior authentication or complex session states.

References