Zephyr's 6LoWPAN IP Header Compression routine performs an out-of-bounds read in get_ihpc_inlined_size(). The routine looks up a destination inline size using an index derived from the IPHC dispatch word. Reserved index values 13–15 are not bounds‑checked and cause a read past the end of a 13‑entry table. The out-of-bounds value is then used in header reconstruction before buffer‑length validation, allowing a crafted packet to trigger a further out-of-bounds read and corrupt the uncompression process. The attacker does not obtain any data; however, the compromised device experiences a denial‑of‑service condition.

Affected systems are devices running Zephyr RTOS that have 6LoWPAN IPHC processing enabled (e.g., subsys/net/ip/6lo.c, subsys/net/l2/ieee802154/ieee802154_6lo.c, and ieee802154_6lo_fragment.c). No specific version numbers are listed, but any build containing the vulnerable code before the commit 1bbb7aefa69eaedc22281ce33aa7a2d5089d5a0e is affected.

The CVSS score is 4.3, giving the vulnerability a medium severity in the CPE model. Because the exploit does not require authentication, any radio‑adjacent attacker can send a malformed 802.15.4 frame that triggers the defect. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack can be performed with off‑the‑shelf radio equipment; the result is a local denial of service that may be repeated until the receiver is powered off or reset.