The vulnerability is a use-after-free in Zephyr’s IPv4 IGMP send path. In igmp_send(), the code reads the packet’s network interface via net_pkt_iface(pkt) after the packet has already been handed to net_send_data(). On the successful‑send path, the packet’s last reference may be released by the L2 driver or the network stack’s TX handling before the interface pointer is retrieved, causing the dereference of freed memory. When per‑interface statistics are enabled, the dangling interface pointer is dereferenced again to update a statistics counter, resulting in a corrupt write. The flaw can be triggered by unauthenticated IGMP membership queries addressed to 224.0.0.1 or by local multicast join/leave/rejoin operations. Introduced with IGMPv2 support, it affects releases from v2.6.0 through v4.4.0. The fix caches the interface pointer before sending. The impact is undefined behavior that can manifest as a sporadic crash or statistics corruption, potentially leading to denial of service.

The vulnerability affects Zephyr RTOS, specifically versions from v2.6.0 through v4.4.0.

The CVSS score for this flaw is 3.7, and the EPSS score is reported as < 1%, indicating a low probability of exploitation. It is not listed in the CISA KEV catalog. While the attack vector is remote and does not require authentication—an attacker can send malformed IGMP packets on a network that reaches the device—the exploit demands a specific timing scenario to cause a controllable memory write. Consequently, the overall risk is moderate but the likelihood of an attacker successfully using it in the wild is low.