CVE-2026-12630

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An out-of-bounds read exists in the 6LoWPAN IP Header Compression (IPHC) uncompression code within the get ihpc inlined size() function. The issue occurs when the system looks up the destination inline size in the da inline size table using an index derived from the M, DAC, and DAM bits of the received IPHC dispatch word. Because the index (a 4-bit value from 0-15) is not bounds-checked, reserved combinations 13, 14, and 15 can cause the system to read past the end of the 13-entry table.

An unauthenticated attacker on a radio or adjacent link can craft a frame with a specific destination addressing-mode nibble to trigger this behavior without privileges or user interaction. The resulting out-of-bounds value is used as the inline size during header reconstruction, which can lead to a size t underflow and a subsequent out-of-bounds read of the packet buffer. This can result in malformed uncompression and a denial-of-service on the receiving device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.