CVE-2026-18418

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The zbus proxy agent IPC backend in subsys/zbus/proxy agent/zbus proxy agent ipc.c contains an issue where the channel name of a rejected inter-domain frame is logged using a plain %s conversion. The zbus proxy msg structure uses a fixed-size channel name[] array that is not guaranteed to be NUL-terminated. When a peer domain sends a frame with an out-of-range message size or a channel name[] lacking a NUL byte, the strlen() function in the log packager reads past the end of the frame object until a zero byte is found. Depending on the backend, this can result in the disclosure of adjacent memory from the IPC work-queue thread stack or shared vring memory into the log sink, or cause a fatal fault if the scan exceeds a mapped region. This requires CONFIG ZBUS PROXY AGENT IPC to be enabled, logging set to warning level or above, and control over the peer domain firmware.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.