zephyr-lwm2m-firmware-update-oob-read-cve-2026-10672-truncated-package-uri

CVE-2026-10672 — PoC чтения за пределами буфера при обновлении прошивки LwM2M в Zephyr Доказательство концепции для CVE-2026-10672 , чтения за пределами буфера в клиенте получения обновления прошивки LwM2M Zephyr RTOS subsys/net/lib/lwm2m/lwm2mpullcontext.c. Уязвимость CVE : CVE-2026-10672 CVSS :...

CVE-2026-14368

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...