zephyr: Stack-based Buffer Overflow
CVE-2026-15894 is a high-severity stack-based buffer overflow vulnerability in zephyr from Zephyr Project, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 4.3.2, 4.4.2 as the first without the flaw, so updating zephyr to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.31% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update zephyr to 4.3.2 or 4.4.2, whichever matches your release line, or a later version.
- Read the advisory on github.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Zephyr Project | zephyr | 3.4.0 up to, but not including, 4.3.2; 4.4.0 up to, but not including, 4.4.2 | 4.3.2, 4.4.2 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- AdjacentThe attacker must be on the same local network segment.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (zephyrproject.org).
Official description
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In sol_pdu_decrypt(), out is allocated as NET_BUF_SIMPLE(17) and then filled with net_buf_simple_add_mem(out, in->data, in->len); net_buf_simple_add() guards its tailroom only with __ASSERT_NO_MSG, which is compiled out in production builds, so when in->len > 17 the underlying memcpy writes attacker-controlled bytes past the 17-byte stack buffer. The copy occurs before any decryption or authentication, so no key material is required to trigger it. The oversized length arises because the mesh scan callback in subsys/bluetooth/mesh/adv.c calls net_buf_simple_restore() before dispatching to bt_mesh_sol_recv(), leaving buf->len covering the entire remaining advertising payload rather than just the Solicitation Service Data. After the parser locates the Service Data AD and consumes the Identification Type byte, the remaining buf->len is the 17-octet Network PDU plus any trailing advertising bytes, and prior to this fix there was no maximum-length check (only a minimum). An attacker can therefore append extra AD structures or padding after the Solicitation Service Data to make buf->len exceed 17. bt_mesh_scan_cb() is registered directly as the BLE scan callback, so buf is raw, unauthenticated advertising data received over the air. Any device in radio range can send a non-connectable advertisement carrying a crafted mesh Proxy Solicitation to a node that has CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled and is currently eligible to be solicited (GATT proxy disabled, On-Demand Private Proxy enabled), with no pairing, bonding, or provisioning. The result is an attacker-controlled stack overwrite — plausibly leading to remote code execution and at minimum a reliable remote denial of service. The fix trims buf->len to the spec-fixed 17 octets (dropping the PDU if fewer remain) before decryption.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Stack-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the stack.
How developers prevent this class of flaw
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
- Use an abstraction library to abstract away risky APIs. Not a complete solution.
- Implement and perform bounds checking on input.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other vulnerabilities in zephyr
- 7.8 High severity
- 7.8 High severity
- 9.1 Critical severity
- 8.3 High severity
- 7.5 High severity
- 7.8 High severity
Recent Stack-based Buffer Overflow vulnerabilities
- 9.8 Critical severity
- 9.8 Critical severity
- 9.8 Critical severity
- 8.1 High severity
- 8.8 High severity
- 9.3 Critical severity
Spotted an error? Tell us.