CVE-2026-12634

In Zephyr's settings NVS backend (subsys/settings/src/settings_nvs.c), three functions (settings_nvs_cache_match, settings_nvs_load, settings_nvs_save) use the nvs_read() return value directly as a NUL-terminator index into 74-byte stack buffers without clamping, causing a single-byte out-of-boun...

CVE-2026-12634 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...

PT-2026-78686

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settings nvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '0', where rc is the return value of nvs read. Per its contract, nvs read returns the full stored entry lengt...