zephyr-lwm2m-firmware-update-oob-read-cve-2026-10672-truncated-package-uri

CVE-2026-10672 — Prueba de Concepto de Lectura Fuera de Límites en la Actualización de Firmware LwM2M de Zephyr Prueba de concepto para CVE-2026-10672 , una lectura fuera de límites en el cliente de extracción de actualización de firmware LwM2M de Zephyr RTOS...

CVE-2026-10672 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

subsys/net/lib/lwm2m/lwm2mpullcontext.c copied the firmware-update Package URI into a fixed static buffer context.uri, size CONFIGLWM2MSWMGMTPACKAGEURILEN, default 128 with memcpycontext.uri, uri, LWM2MPACKAGEURILEN, copying exactly the destination size with no length validation. The...

CVE-2026-10672

CVE-2026-10672 affects Zephyr LwM2M firmware Update pull: a memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN) into a 128-byte buffer, with no length validation, copies up to 128 bytes of a server URI and omits the NUL terminator. Subsequent strlen and CoAP/PROXY_URI parsing read past the end into a...

CVE-2026-10672 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

subsys/net/lib/lwm2m/lwm2mpullcontext.c copied the firmware-update Package URI into a fixed static buffer context.uri, size CONFIGLWM2MSWMGMTPACKAGEURILEN, default 128 with memcpycontext.uri, uri, LWM2MPACKAGEURILEN, copying exactly the destination size with no length validation. The...