CVE-2026-75085 zephyrproject CVE debrief

Who should care

Defenders responsible for Zephyr-based systems, specifically those using versions 4.3.0 up to 4.4.2, should assess their exposure and prioritize patching to prevent potential exploitation.

Why it matters

CVE-2026-75085 is a MEDIUM-severity vulnerability in the STM32WBA IEEE 802.15.4 driver that can lead to potential buffer overflows. Defenders should prioritize patching affected Zephyr systems and verify frame length validation to prevent exploitation.

• Verify frame length validation to prevent buffer overflows.
• Patch affected systems to ensure secure communication.
• Monitor network traffic for potential exploitation attempts.

Technical summary

The STM32WBA IEEE 802.15.4 driver in Zephyr incorrectly calculates the packet length of a received frame, leading to a potential buffer overflow. The vulnerability occurs when the driver performs an out-of-bounds read due to an underflow in the packet length calculation. The packet length is calculated as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without checking if the radio-reported length can hold an FCS. This can lead to an underflow and a potential buffer overflow. The vulnerability affects Zephyr-based systems, specifically those using versions 4.3.0 up to 4.4.2. Defenders should prioritize patching affected systems and verify the integrity of received frames to prevent exploitation.

Defensive priority

Defenders should prioritize patching affected systems, specifically Zephyr versions 4.3.0 up to 4.4.2, and verify the integrity of received frames to prevent exploitation.

Recommended defensive actions

• Patch affected Zephyr systems (versions 4.3.0 up to 4.4.2) with the provided fix.
• Verify the integrity of received frames to prevent exploitation.
• Monitor network traffic for suspicious activity.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the lack of validation of the received frame length in the STM32WBA IEEE 802.15.4 driver. The packet length is calculated as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without checking if the radio-reported length can hold an FCS. This can lead to an underflow and a potential buffer overflow.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.