An integer overflow occurs during dynamic kernel object allocation when the kernel combines a base size with a user‑supplied size without checking for unsigned wrap‑around. If the user supplies a value close to SIZE_MAX, the result wraps to a very small allocation while the object descriptor still claims the full requested size. The unprivileged user‑mode thread can then write beyond the truncated heap region, corrupting sys_heap metadata and adjacent kernel objects, and may also write a user‑controlled pointer as a privileged stack base. The consequence is a loss of the CONFIG_USERSPACE sandbox, enabling kernel‑level code execution or, at minimum, kernel memory corruption and system compromise.

The vulnerability resides in the Zephyr RTOS kernel, specifically in the userspace support for dynamic object allocation. While no particular release is listed, any Zephyr build that enables CONFIG_USERSPACE together with CONFIG_DYNAMIC_OBJECTS or the derived CONFIG_DYNAMIC_THREAD may be affected. The flaw is present in the dynamic_object_create routine and can also be triggered via the k_thread_stack_alloc syscall. Vendors using Zephyr in IoT and embedded devices should verify whether these configuration options are active.

The CVSS score of 8.8 classifies this issue as high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires a local user‑mode thread on a system that has userspace enabled and a configured resource pool. The likely attack vector is local, with no network exposure required. Once the overflow is triggered, the attacker can corrupt kernel memory or gain privilege escalation, making the risk substantial. Although no publicly available exploit is documented, the combination of high severity and the conditions that must be present in a typical Zephyr deployment warrants immediate remediation.