7 matches found
CVE-2026-18418
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
CVE-2026-18418 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
CVE-2026-18418 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
EUVD-2026-97104
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
CVE-2026-18418 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
CVE-2026-18418: Out-of-bounds Read
The zbus proxy agent IPC backend in subsys/zbus/proxyagent/zbusproxyagentipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbusproxymsg carries a fixed-size channelname array as its last member, and nothing in the transport guarantees...
PT-2026-110218
The zbus proxy agent IPC backend in subsys/zbus/proxy agent/zbus proxy agent ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus proxy msg carries a fixed-size channel name array as its last member, and nothing in the transport...