Out-of-Bounds Read Vulnerability in Zephyr's IPv6 Networking Stack

CVE-2026-19577

What is CVE-2026-19577?

A vulnerability exists in the Zephyr OS networking stack that allows for an out-of-bounds read in the IPv6 packet processing function, net_route_ipv6_packet(). This flaw occurs when the system resolves the nexthop's link-layer address without verifying the validity of the neighbor cache entry. If an attacker manages to create an unresolved neighbor state, it leads to the potential exposure of sensitive memory content. The flaw may result in a remote denial of service or unintentional disclosure of memory contents to any listener on the same link. This vulnerability affects routers and devices using IPv6 networking and could be exploited without any need for authentication, putting devices at risk.

References