CVE-2026-10849 zephyrproject CVE debrief

Who should care

Organizations using the hawkBit device management client in subsys/mgmt/hawkbit should be aware of this vulnerability and take steps to patch or mitigate it to prevent potential denial of service via heap corruption.

Technical summary

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb(). The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the full response has arrived, the code writes response_data[downloaded_size] = '' — and whenever the accumulated body length equals the allocation, that terminator lands one byte past the end of the heap object (a heap-based out-of-bounds write, CWE-122 / CWE-787).

Defensive priority

Organizations using the hawkBit device management client in subsys/mgmt/hawkbit should prioritize patching to prevent potential denial of service via heap corruption.

Recommended defensive actions

• Patch the hawkBit device management client to prevent potential denial of service via heap corruption
• Review and update affected systems to ensure they are not vulnerable
• Monitor for suspicious activity related to hawkBit device management client
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE description details a heap-based out-of-bounds write vulnerability in the hawkBit device management client. The vulnerability is due to the accumulation of HTTP response bodies into a heap buffer without reserving space for a terminating NUL. The body length and fragmentation are controlled by the remote hawkBit server, making it remotely reachable. The fix sizes the buffer to the body length plus one and copies with memcpy, ensuring the terminator always lands within the allocation.

Official resources