The vulnerability resides in the Zephyr ATAES132A crypto driver. Malformed responses with an oversized length field overflow a 52‑byte stack buffer, enabling a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution. This is a classic stack buffer overflow (CWE‑120).

Affected products include Zephyr RTOS version 4.3.0 and its release candidate builds rc1 through rc3 from the zephyrproject‑rtos vendor.

The CVSS score of 3.8 indicates a moderate risk, and the EPSS score indicates less than a 1% chance that an exploit is actively used. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to have a compromised device or bus level access to send a malicious response, so the attack vector is local/internal to the device. Given the low probability of exploitation and moderate impact, it remains prudent to patch promptly.