CVE-2026-12634

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The NVS backend of the settings subsystem in subsys/settings/src/settings nvs.c contains an out-of-bounds write issue. The system reads stored setting-name entries into fixed 74-byte stack buffers and uses the return value of the nvs read() function to NUL-terminate the buffer. Because nvs read() can return a length exceeding the buffer size, a single NUL byte may be written past the end of the stack buffer at an offset controlled by the attacker. This occurs within the settings nvs cache match(), settings nvs load(), and settings nvs save() functions.

This issue cannot be triggered via the standard settings API but requires the ability to write directly to the flash memory backing the settings partition, such as through a co-resident untrusted component, a malicious settings restore image, or physical flash access. The malformed entry is processed during boot, subsystem initialization via settings load(), or during settings save(). The practical impact is limited to stack corruption, resulting in a system crash or denial of service.

Recommendations Update the software to a version where the nvs read() length is validated to be smaller than the buffer size before the NUL termination is performed.