Description
The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap.

When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path.

The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write.

The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.
Published: 2026-08-10
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the UpdateHub OTA client's probe routine, where a heap buffer that should contain metadata is copied without terminating the null byte. The subsequent string length calculation over this uninitialized memory can silently read past the allocated bounds, potentially triggering a crash of the update thread or device. Although only an internal read occurs and no attacker-controlled data is returned, the resulting denial of service can be induced by a malicious or compromised UpdateHub server, or by any server if communications are not encrypted.

Affected Systems

Zephyr RTOS, specifically the UpdateHub module located in subsys/mgmt/updatehub/updatehub.c. Any deployment of Zephyr that enables the OTA UpdateHub feature and employs the probe function is affected. No explicit product version range is supplied, so all releases containing the unpatched probe logic are potentially impacted.

Risk and Exploitability

The CVSS score of 3.7 indicates low overall severity, but the denial of service attack vector is network-based and can originate from the UpdateHub server, which may be compromised or act maliciously. The EPSS score is not available, and the vulnerability is not catalogued in CISA KEV. Since the code path is exercised when the probe response fails the first JSON parse, an attacker can craft a payload to trigger the faulty routine. The lack of external information disclosure or memory write limits the impact to a local crash, yet any device relying on OTA updates can become unavailable if exploited.

Generated by OpenCVE AI on August 10, 2026 at 23:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Zephyr to the patched release containing commit 69bbed5e, which zeroes the temporary metadata buffer before copying.
  • If an immediate upgrade is not possible, enable CONFIG_UPDATEHUB_DTLS to enforce secure communication or disable the UpdateHub OTA feature to eliminate the vulnerable code path.
  • Enable logging of UpdateHub probe failures and configure alerts for repeated, anomalous failure patterns to detect potential exploitation attempts.

Generated by OpenCVE AI on August 10, 2026 at 23:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 10 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Description The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.
Title UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata
Weaknesses CWE-125
CWE-908
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-10T20:36:33.022Z

Reserved: 2026-06-09T15:51:47.489Z

Link: CVE-2026-11809

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T02:45:06Z

Weaknesses