Zephyr’s Precision Time Protocol (PTP) handler ptp_msg_post_recv() extracts a 4‑bit message type from the incoming frame and uses it unconstrained as an index into a size table that only defines entries for types 0–0xD. When a type 0xE or 0xF is received, the index falls past the end of the array, causing an out‑of‑bounds read of adjacent read‑only data. The value read is then repurposed as a length; if it is small or negative, it produces a large positive budget that drives the TLV parser past the received payload, performing further out‑of‑bounds reads and in‑place byte‑swap writes beyond the allocated slab. This chain ultimately results in a crash, with a limited memory‑corruption path that an attacker cannot reliably tune. The vulnerability is directly triggered by network traffic.

The flaw affects Zephyr project:Zephyr systems that have CONFIG_PTP enabled. No specific kernel or application versions are listed, so any build exposing the unpatched ptp_msg_post_recv() function is vulnerable.

The CVSS score of 6.5 classifies the crash as a moderate severity flaw. The EPSS score is unavailable, so the likelihood of automated exploitation is unclear, but PTP traffic is unauthenticated and broadcast or multicast, meaning any host on the same link can send crafted frames. The flaw is not listed in the CISA KEV catalog, yet it can cause a denial of service without requiring privileged access. The vulnerability is exploitable directly from the network via standard PTP transports over UDP multicast or raw Ethernet 0x88F7.