Out-of-Bounds Write Vulnerability in Zephyr Network Sockets by Zephyr Project

CVE-2026-5066

What is CVE-2026-5066?

The vulnerability arises in the TLS socket connection path within the network sockets subsystem of Zephyr RTOS, where improper handling of the addrlen parameter can result in out-of-bounds memory access. Specifically, when TLS session cache features are enabled, functions tls_session_store() and tls_session_restore() fail to validate the length of the caller-supplied address against the fixed-size buffer. This creates the risk of copying more data than intended into the buffer, leading to potential crashes, denial of service, or even arbitrary code execution by malicious entities.

References