CVE-2026-13217 NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg the code calls atoistrtokruid, "-", &tmp without checking the strtokr return value. When the server-supplied uid is empty or contains no -...

EUVD-2026-65598

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg the code calls atoistrtokruid, "-", &tmp without checking the strtokr return value. When the server-supplied uid is empty or contains no -...

CVE-2026-13217

The Zephyr RTOS OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c contains a NULL-pointer dereference in ocpp_process_server_msg(). When parsing the uid field of a CALLRESULT message, atoi(strtok_r(uid, "-", &tmp)) is called without checking whether strtok_r() returned NULL. A malicious or compromise...

CVE-2026-10848 Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parserpcmsg subsys/net/lib/ocpp/ocppj.c using a hand-rolled helper, extractstringfield, that copied the message's uid and action fields with strncpyoutbuf, token + 1, outlen - 1 and then scanned the result with...