CVE-2026-11809

Name of the Vulnerable Software and Affected Versions UpdateHub OTA client (affected versions not specified)

Description An out-of-bounds and uninitialized-memory read exists in the z impl updatehub probe() function within subsys/mgmt/updatehub/updatehub.c. The issue occurs when a probe response from the UpdateHub server is copied into a heap buffer named metadata copy using memcpy(), which fails to include the terminating NUL character. If the initial json obj parse() call fails, the system attempts a fallback using strlen() on metadata copy. Because the buffer is not NUL-terminated, strlen() may scan through uninitialized heap memory and read beyond the buffer boundaries. A malicious or compromised UpdateHub server can trigger this behavior by sending a specifically crafted large payload. This can lead to a network-triggerable denial of service by causing the update thread or device to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.