CVE-2026-10672

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.0.0 through 4.4.0

Description In the subsys/net/lib/lwm2m/lwm2m pull context.c file, the firmware-update Package URI is copied into a fixed static buffer context.uri using memcpy() without length validation. Because the source buffer can be up to 255 bytes while the destination buffer is only 128 bytes, a management server or an on-path attacker can provide a URI that fills the buffer without a NUL terminator. This leads to an out-of-bounds read of adjacent static memory when the buffer is processed as a C string by http parser parse url(), lwm2m parse peerinfo(), and during CoAP URI-path or PROXY-URI option appends. This can result in the disclosure of device memory via outbound CoAP requests or cause a denial of service by crashing the device.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary mitigation, disable the CONFIG LWM2M FIRMWARE UPDATE PULL SUPPORT configuration path.