Description
subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM2M management server (or an on-path attacker on a session lacking strong DTLS) can WRITE a URI of 128-254 characters; only the first 128 bytes are then copied into context.uri with no NUL terminator. That buffer is subsequently consumed as a C string by http_parser_parse_url(context.uri, strlen(context.uri), ...), strlen-based CoAP URI-path/PROXY-URI option appends, and lwm2m_parse_peerinfo(), causing an out-of-bounds read of adjacent static memory. The over-read bytes are appended to outbound CoAP requests (information disclosure of adjacent device memory to the server/proxy) and can crash the device (denial of service). The vulnerable copy was introduced by the pull-context refactor (first released in v3.0.0) and is present through v4.4.0; the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected. The fix adds a strlen(uri) >= sizeof(context.uri) check returning -ENOMEM and switches to strcpy(), guaranteeing a bounded, NUL-terminated buffer.
Published: 2026-07-14
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw lives in Zephyr's LwM2M firmware pull component, where a memcpy copies a server-supplied Package URI into a fixed 128‑byte buffer without checking the length or inserting a NUL terminator. When the URI is between 128 and 254 characters, the copy overwrites the buffer boundary and leaves garbage after the 128th byte. Subsequent code interprets this buffer as a C string, causing an out‑of‑bounds read of adjacent static memory. This flaw enables an attacker to read unrelated device memory (information disclosure) and can also trigger a crash of the Zephyr runtime (denial of service). The weakness is classified as CWE‑125.

Affected Systems

The vulnerability impacts Zephyr RTOS in its LwM2M firmware pull component. It exists in the codebase from the refactor first released in version 3.0.0 through version 4.4.0, and the vulnerability is triggered by the default‑on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT configuration.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity, while the EPSS score is below 1% and the flaw is not included in the CISA KEV catalogue. Exploitation requires only a remote LwM2M management server or an on‑path attacker with a session that is not protected by strong DTLS to send a long URI; no special credentials are needed. Once the long URI is accepted, the out‑of‑bounds read can expose neighboring memory contents to the attacker or cause a crash of the device, resulting in both information disclosure and denial of service.

Generated by OpenCVE AI on July 31, 2026 at 10:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Zephyr patch that introduces a length check before copying the URI (e.g., the commit identified by 99a164df5cea5af76e32b57c6d51854f018969a2 or any release newer than v4.4.0).
  • If firmware updates via LwM2M pull are not required for the deployment, disable the CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT configuration flag to eliminate the vulnerable code path.
  • As an interim protection, configure the firmware update server to issue Package URIs no longer than 127 characters or enforce a length check on the server side so that the Zephyr device never receives an over‑long URI.

Generated by OpenCVE AI on July 31, 2026 at 10:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Tue, 14 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Description subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM2M management server (or an on-path attacker on a session lacking strong DTLS) can WRITE a URI of 128-254 characters; only the first 128 bytes are then copied into context.uri with no NUL terminator. That buffer is subsequently consumed as a C string by http_parser_parse_url(context.uri, strlen(context.uri), ...), strlen-based CoAP URI-path/PROXY-URI option appends, and lwm2m_parse_peerinfo(), causing an out-of-bounds read of adjacent static memory. The over-read bytes are appended to outbound CoAP requests (information disclosure of adjacent device memory to the server/proxy) and can crash the device (denial of service). The vulnerable copy was introduced by the pull-context refactor (first released in v3.0.0) and is present through v4.4.0; the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path is affected. The fix adds a strlen(uri) >= sizeof(context.uri) check returning -ENOMEM and switches to strcpy(), guaranteeing a bounded, NUL-terminated buffer.
Title Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-14T18:38:47.765Z

Reserved: 2026-06-02T15:25:35.843Z

Link: CVE-2026-10672

cve-icon Vulnrichment

Updated: 2026-07-14T15:28:33.070Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T10:30:17Z

Weaknesses