CVE-2026-16514

gptpmiqualifyannounce in subsys/net/l2/ethernet/gptp/gptpmi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce-stepsremoved accepted up to 254...

EUVD-2026-82948

gptpmiqualifyannounce in subsys/net/l2/ethernet/gptp/gptpmi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce-stepsremoved accepted up to 254...

CVE-2026-16514

CVE-2026-16514 is an out-of-bounds read in Zephyr RTOS 's gPTP implementation (gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c). The loop bound for validating the Path Trace TLV of IEEE 802.1AS Announce messages was taken from the attacker-controlled steps_removed field (up to...