PT-2026-25508

CVE-2026-0849

Published

2026-03-14

Updated

2026-03-16

Description by

CVSS 3.1

6.8

Medium

MetricsAV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The Zephyr crypto driver contains a flaw where malformed ATAES132A responses with an oversized length field can cause a 52-byte stack buffer overflow. This allows a compromised device or a bus attacker to potentially corrupt kernel memory and hijack execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Enitmar

Max-R-B

Vendors

Affected products

Weakness enumeration

CWE-120: Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\')

Related identifiers