A vulnerable getsockopt call in Zephyr’s TLS subsystem passes the caller’s optval directly to mbedTLS without verifying the buffer length. When the length supplied is smaller than the maximum DTLS Connection ID size (32 bytes), the copied CID overflows the destination buffer, potentially writing up to 31 bytes beyond its end. This out‑of‑bounds write occurs on the kernel heap when CONFIG_USERSPACE is enabled, allowing an unprivileged user thread to corrupt kernel memory. The weakness is a classic buffer overflow (CWE‑787) that can lead to process crash or privilege escalation.

The flaw exists in Zephyr Project: Zephyr OS, introduced with the TLS_DTLS_CID option in version 3.5.0 and present in all later releases until patched. It requires the CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID option and an established DTLS session with a negotiated peer CID. Devices running Zephyr with userspace enabled and DTLS Connection ID support are thus impacted.

The CVSS score is 8.4, indicating high severity, and the vulnerability is not listed in the CISA KEV catalog. Although EPSS data are unavailable, the attack can be performed by any unprivileged user that can invoke getsockopt on a connected DTLS socket. Because the overflow writes data supplied by a remote peer, an attacker could craft a malicious CID to influence the kernel heap layout, potentially enabling arbitrary code execution or privilege escalation. The combination of kernel‑heap corruption and lack of buffer‑size checks makes exploitation straightforward once the conditions are met.