Loading story…
A high-severity vulnerability tracked as CVE-2026-10849 was disclosed in the Zephyr RTOS hawkBit OTA client, where an off-by-one error in response_json_cb() can write a terminating NUL byte past the end of a heap buffer while processing an HTTP response body. The flaw affects Zephyr versions 2.4.0 through 4.4.x and is remotely reachable because a hawkBit server can control response length and fragmentation, including in scenarios involving a malicious, compromised, or man-in-the-middle update server. The issue carries a CVSS 3.1 score of 8.2 and is expected to primarily cause heap corruption and denial of service, with some potential for broader corruption depending on the allocator.
The Zephyr Project addressed the bug in commit 59d7ab58d853489e6134081cadb11733730264ac, which corrects the buffer sizing logic to allocate body length plus one byte for the trailing terminator. The patch also replaces strncpy with memcpy when copying the response fragment so the terminator remains within bounds, eliminating the out-of-bounds write condition in the hawkBit management subsystem.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-10849 was published as a high-severity heap out-of-bounds write vulnerability affecting Zephyr versions 2.4.0 through before 4.5.0. The issue allows a remote hawkBit server to trigger heap corruption in response_json_cb(), primarily causing denial of service, and the record references the Zephyr fix commit and GitHub advisory GHSA-39h3-7phx-pwhv.
A Zephyr Project RTOS commit fixed an off-by-one error in the hawkBit management subsystem by allocating space for a trailing NUL byte and replacing strncpy with memcpy in response_json_cb(). The patch was committed in the public repository as commit 59d7ab58d853489e6134081cadb11733730264ac.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, **CVE-2026-10673**, was disclosed in the Zephyr RTOS `ADIN2111/ADIN1110` 10BASE-T1S/T1L Ethernet driver, affecting versions **3.7.0 through 4.4.0**. The flaw is an out-of-bounds write in OA SPI RX frame reassembly: attacker-controlled 64-byte chunks can be copied into a fixed static buffer without verifying that the write cursor stays within bounds. An attacker on the adjacent single-pair Ethernet segment can send an oversized frame to corrupt memory in the driver's RX offload thread, causing denial of service and potentially enabling code execution. Zephyr addressed the issue with May 1 patches that add bounds checking and state reset logic when a received packet exceeds `CONFIG_ETH_ADIN2111_BUFFER_SIZE`, dropping oversized frames and resetting `ctx->scur`. A related fix also corrected the Open Alliance buffer size calculation from `255 × 64` bytes to `255 × 68` bytes to account for each chunk's 4-byte header in addition to 64 bytes of data. The vulnerability was traced to OA SPI support introduced in commit `0ca8b0756b1`, and published scoring indicates **CVSS 8.6** with proof-of-concept exploitation status reported in CISA SSVC metadata.
Jul 16, 2026
A high-severity flaw tracked as **`CVE-2026-12366`** was disclosed in the Zephyr RTOS, where userspace object disposal could free an armed, dynamically allocated **`k_timer`** without first cancelling its queued timeout. The bug leaves a dangling entry in the global timeout queue, and when the timer later expires, Zephyr may dereference freed kernel heap memory in kernel or ISR context, creating a deterministic use-after-free and memory-corruption condition. The issue is reachable by an unprivileged user thread when **`CONFIG_USERSPACE`** and **`CONFIG_DYNAMIC_OBJECTS`** are enabled, making it a potential sandbox-escape and local privilege-escalation primitive. Zephyr addressed the problem in a kernel change that adds **`k_timer_cleanup()`**, which cancels the timer, waits for any in-flight expiration handler to finish, and can return **`-EAGAIN`** if threads are still pending on the timer wait queue; the fix also updates userspace cleanup logic and tracing hooks to use the safer timer cleanup path.
Aug 14, 2026
Red Hat disclosed two **heap over-read** vulnerabilities in **OVN (Open Virtual Network)** that can leak memory from `ovn-controller` back to attacker-controlled workloads. **`CVE-2026-5367`** affects DHCPv6 Client ID processing: when the userspace `pinctrl` thread builds a DHCPv6 ADVERTISE reply, it echoes a Client ID option using an attacker-supplied length field without checking packet bounds. A malicious workload can send a crafted DHCPv6 SOLICIT packet with an inflated Client ID length and cause heap data beyond the valid packet buffer to be copied into the reply and returned to the VM port, particularly in deployments where DHCPv6 options are configured on Logical Switch Ports. A second flaw, **`CVE-2026-5265`**, affects ICMP error generation in the same component. OVN copies packet data into ICMP Destination Unreachable or Packet Too Big responses based on self-declared IPv4 or IPv6 length fields without validating them against the actual buffer size, allowing a malicious VM to send truncated packets with inflated length values and receive adjacent heap memory in the ICMP reply. The issue can be triggered through reject ACLs, Gateway MTU checks, or reject-configured load balancers. Users were advised to apply patches or upgrade to fixed releases including **`v24.03.8`**, **`v25.03.3`**, **`v25.09.3`**, and **`v26.03.1`**; for `CVE-2026-5367`, **`v24.09.4`** is also listed as fixed, while Red Hat noted the previously referenced `24.09` release for `CVE-2026-5265` will not occur.
Jun 29, 2026