CVE-2026-10848 zephyrproject CVE debrief

Who should care

Users of the OCPP 1.6 client in subsys/net/lib/ocpp, particularly those with EXPERIMENTAL feature CONFIG_OCPP enabled, should be aware of this vulnerability and take necessary actions to mitigate it. This includes operators of affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of their systems.

Technical summary

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '“). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a “ byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. The parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c).

Defensive priority

High

Recommended defensive actions

• Apply the official patch or update to a fixed version
• Implement compensating controls such as monitoring and exception tracking
• Review and update the affected system's configuration and inventory
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the improper use of strncpy and strchr functions in the parse_rpc_msg() function. The strncpy function does not NUL-terminate the destination when the source is at least outlen - 1 bytes long, leading to out-of-bounds access when using strchr. A related defect in extract_payload() also runs strchr/strrchr over the receive buffer, which may not be NUL-terminated.

Official resources