PT-2026-144850

CVE-2026-82391

Published

2026-11-10

Updated

2026-11-11

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.3.2 Zephyr versions prior to 4.5.0

Description An out-of-bounds write exists in the HTTP/2 front-end of the Zephyr HTTP server when serving static files. The issue occurs in the handle http2 static fs resource() function within subsys/net/lib/http/http server http2.c, where the &client->data len variable is incorrectly used as the file size out-parameter for http server find file(). This causes the receive buffer length to be replaced by the actual size of the file on disk.

An unauthenticated attacker can trigger this by sending an HTTP/2 GET request for any file under the web root in applications where CONFIG FILE SYSTEM=y and CONFIG HTTP SERVER VERSION 2 is enabled. This leads to several memory safety issues:

Out-of-bounds reads in parse http frame header() and per-frame handlers.
A buffer overflow during a memmove() operation that overwrites the http client ctx structure, including function-pointer tables and timers.
An out-of-bounds write via zsock recv() due to a size argument underflow.

This remote memory corruption can result in a device crash, hang, or potential arbitrary code execution.

Recommendations Update Zephyr to version 4.3.2. Update Zephyr to version 4.5.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Shadowbyte1

Vendors

Affected products

Weakness enumeration

CWE-787: Out-of-bounds Write