CVE-2026-10849

Name of the Vulnerable Software and Affected Versions Zephyr RTOS (affected versions not specified)

Description The hawkBit device management client accumulates the body of an HTTP response from an update server into a heap buffer using the response json cb() function. The buffer is sized to hold the received body bytes but does not reserve space for a terminating NUL character. When the full response is received, the code writes a NUL terminator one byte past the end of the heap object, resulting in a heap-based out-of-bounds write. This occurs because the body length and fragmentation are controlled by the remote server via rsp->body frag start and rsp->body frag len. A malicious, compromised, or man-in-the-middle server can trigger this by sending a response body that matches or exceeds the buffer allocation size. This heap corruption can lead to a denial of service due to faults during subsequent memory allocations or frees.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.