An out‑of‑bounds write occurs when the Zephyr settings subsystem reads a stored setting name into a 74‑byte stack buffer and writes a terminating NUL byte at the index returned by nvs_read(). Because nvs_read() can return a value larger than the buffer, a crafted entry exceeding the buffer length will cause the NUL byte to be written past the end of the stack frame. The effect is a single byte overflow that can corrupt adjacent stack data and lead to a crash or denial of service. The flaw does not provide an attacker with code execution or confidentiality loss. It is formally classified as CWE‑787, Out‑of‑Bounds Write.

The vulnerability exists in the Zephyr real‑time operating system, specifically in the settings NVS backend located in subsys/settings/src/settings_nvs.c. The flaw affects any device running a Zephyr build that includes the settings subsystem and has a settings partition backed by flash, regardless of the specific Zephyr version, as no version is currently known to contain the fix.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, reducing its prominence among actively exploited weaknesses. Exploitation requires an actor with write access to the flash partition used for settings—either a co‑resident or untrusted component, a malicious firmware image, or offline physical access to the device. This limits the attack surface and makes remote network attacks infeasible. If the attacker can inject a malformed entry, the exploit will trigger during boot or when the settings subsystem is initialized, causing a crash rather than reliable code execution.