Denial of Service Vulnerability in Object Transfer Service by Zephyr Project

CVE-2026-81038

What is CVE-2026-81038?

The Object Transfer Service in the Zephyr Project is vulnerable to a denial of service due to improper handling of the Checksum Value field in the Object Action Control Point response. An attacker can exploit this vulnerability without any authentication or encryption, allowing them to trigger a failure path that leads to uninitialized memory being transmitted over the network. This results in the potential exposure of sensitive information and service disruption, especially on configurations with assertions enabled, ultimately compromising system integrity and availability.

References