Buffer Overflow Vulnerability in OSDP Control Panel by Zephyr Project

CVE-2026-76788

What is CVE-2026-76788?

A buffer overflow vulnerability exists in the OSDP Control Panel's reply parser within the Zephyr Project, where insufficient validation of reply lengths allows for possible arbitrary data overflow into stack-allocated structures. This can result in unpredictable behaviors, including potential crashes or control-flow hijacking, due to manipulated or malicious inputs through the RS-485 communication channel. The flaw arises when the system processes oversized replies that do not adhere to established size limits, leading to exposure of critical memory areas. The vulnerability can be exploited by an attacker with access to the communication bus or through compromised devices. Resolution involves implementing strict size checks to buffer write operations.

References