CVE-2026-18746

The Zephyr LwM2M client is vulnerable to a NULL pointer dereference in the parse_write_op() function within subsys/net/lib/lwm2m/lwm2m_message_handling.c. When the static CoAP Block1 context pool (defaulting to 3 entries) is exhausted, the init_block_ctx() function returns -ENOMEM and sets the ca...