Denial of Service Issue in UpdateHub Firmware Client by Zephyr

CVE-2026-76787

What is CVE-2026-76787?

The UpdateHub firmware client within Zephyr's ecosystem exhibits a vulnerability that allows for a denial of service through unverified network responses. In particular, the client fails to adequately validate the 'sha256sum' field in incoming JSON probe responses. If the field is omitted, subsequent operations attempt to access this NULL pointer, leading to system crashes. This vulnerability is exploitable by an attacker on the network who is able to manipulate the probe responses without needing user interaction. Depending on the system architecture, the resulting denial of service may vary, but it fundamentally exposes systems to disruptive failures due to the unhandled NULL pointer dereference. A patch has been implemented to check for the NULL condition before processing, addressing the risk posed by this vulnerability.

References