The vulnerability is an out‑of‑bounds read in the PTP management‑message parser for the PTP_MGMT_TIME identifier. The parser casts the TLV data buffer to a 10‑byte struct without first verifying that the buffer contains the required length, causing the read of eight bytes beyond the validated data. The subsequent byte‑swap and write‑back corrupt adjacent in‑object memory, resulting in small information leakage and an alteration of the device’s parsed TIME value. No crash or reference‑count corruption occurs, and the corruption remains bounded within the message allocation.

All Zephyr RTOS installations that enable CONFIG_PTP on a local PTP network segment are affected. The flaw resides in the Zephyr networking stack under subclasses net/lib/ptp/tlv.c, affecting any device that participates in IEEE 1588 PTP management traffic.

With a CVSS score of 5.4 the flaw is of moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. An attacker must be on the same local PTP segment and able to send a crafted PTP_MSG_MANAGEMENT packet; no elevated privileges are required. Successful exploitation yields limited information disclosure and corruption of the parsed timestamp but does not cause a crash or remote code execution.