CVE-2026-126957

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An integer underflow exists in the IPv4 option handling of the system. A remote, unauthenticated attacker can read stack memory by sending an ICMP Echo Request containing an IPv4 Record Route or Timestamp option. The functions icmpv4 update record route() and icmpv4 update time stamp() in subsys/net/ip/icmpv4.c calculate the length of recorded data using uint8 t arithmetic. Because the attacker-controlled Pointer field is not validated against the RFC 791 minimum requirements (4 for Record Route and 5 for Timestamp), a small value can cause the length to wrap up to 252 bytes. Consequently, net pkt write() reads beyond the 40-byte opt data stack buffer, leaking up to 213 bytes of stack memory, including stack and heap pointers, in the ICMP Echo Reply. This process can be repeated without crashing the device. The issue affects devices built with CONFIG NET IPV4 HDR OPTIONS, which is selected by CONFIG NET IPV4 IGMP.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.