PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10672 zephyrproject CVE debrief

The CVE record describes a vulnerability in the Zephyr project's net subsystem, where a buffer overflow occurs when copying a server-supplied Package URI into a fixed static buffer without length validation, leading to an out-of-bounds read and potential information disclosure or denial of service. The affected product context includes Zephyr project's net subsystem, particularly those using versions 3.0.0 through 4.4.0 with CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT enabled. Evidence limits suggest that additional review of adjacent device memory and potential information disclosure or denial of service is required. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. Users of Zephyr project's net subsystem, particularly those using versions 3.0.0 through 4.4.0 with CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT enabled, should review and update affected versions of Zephyr, monitor for potential exploitation attempts, and verify affected product deployments. The vulnerability was introduced by the pull-context refactor in version 3.0.0 and is present through version 4.4.0. The default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected.

Vendor
zephyrproject
Product
zephyr
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-08-06
Advisory published
2026-07-14
Advisory updated
2026-08-06

Who should care

Users of Zephyr project's net subsystem, particularly those using versions 3.0.0 through 4.4.0 with CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT enabled, should review and update affected versions of Zephyr, monitor for potential exploitation attempts, and verify affected product deployments.

Technical summary

The vulnerability occurs in the lwm2m_pull_context.c file, where a server-supplied Package URI is copied into a fixed static buffer without length validation, leading to an out-of-bounds read and potential information disclosure or denial of service. The affected product context includes Zephyr project's net subsystem, particularly those using versions 3.0.0 through 4.4.0 with CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT enabled.

Defensive priority

High priority due to potential for information disclosure and denial of service

Recommended defensive actions

  • Apply the patch from https://github.com/zephyrproject-rtos/zephyr/commit/99a164df5cea5af76e32b57c6d51854f018969a2
  • Follow vendor advisory from https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf
  • Verify and update affected versions of Zephyr
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was introduced by the pull-context refactor in version 3.0.0 and is present through version 4.4.0. The default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected. Evidence limits suggest that additional review of adjacent device memory and potential information disclosure or denial of service is required. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T15:16:55.560Z and has not been modified since then.