CVE-2026-10672 zephyrproject CVE debrief

Who should care

Users of Zephyr project's net subsystem, particularly those using versions 3.0.0 through 4.4.0 with CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT enabled, should review and update affected versions of Zephyr, monitor for potential exploitation attempts, and verify affected product deployments.

Technical summary

The vulnerability occurs in the lwm2m_pull_context.c file, where a server-supplied Package URI is copied into a fixed static buffer without length validation, leading to an out-of-bounds read and potential information disclosure or denial of service. The affected product context includes Zephyr project's net subsystem, particularly those using versions 3.0.0 through 4.4.0 with CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT enabled.

Defensive priority

High priority due to potential for information disclosure and denial of service

Recommended defensive actions

• Apply the patch from https://github.com/zephyrproject-rtos/zephyr/commit/99a164df5cea5af76e32b57c6d51854f018969a2
• Follow vendor advisory from https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rf6j-4mpp-j9mf
• Verify and update affected versions of Zephyr
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was introduced by the pull-context refactor in version 3.0.0 and is present through version 4.4.0. The default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected. Evidence limits suggest that additional review of adjacent device memory and potential information disclosure or denial of service is required. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.