7 matches found
CVE-2026-12633
The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...
CVE-2026-12633 Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement
The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...
EUVD-2026-63074
The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...
CVE-2026-12633 Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement
The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...
CVE-2026-12633
CVE-2026-12633 is an out-of-bounds write in the Zephyr RTOS IPv6 neighbor-discovery code (subsys/net/ip/ipv6_nbr.c). The function handle_ra_6co() processes the 6LoWPAN Context Option (RFC 6775) from ICMPv6 Router Advertisements without bounding the 8-bit context_len field to the RFC maximum of 12...
PT-2026-78685
The IPv6 neighbor-discovery code in subsys/net/ip/ipv6 nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handle ra 6co the 8-bit context len field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...
CVE-2026-12633: Out-of-bounds Write
The IPv6 neighbor-discovery code in subsys/net/ip/ipv6nbr.c processes the 6LoWPAN Context Option 6CO, RFC 6775 carried inside ICMPv6 Router Advertisements. In handlera6co the 8-bit contextlen field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function...