Read the docs
TI-2026-09168 Aliases CVE-2026-10666

Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

Priority HIGH 76CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte stack buffer (char ipaddr[NET_IPV4_ADDR_LEN + 1]) using a length of str_len - end - 1, where str_len is the full, unbounded input length and end is only the (<=15-byte) offset of the ':' delimiter. Because the destination size is never consulted, a crafted address string with a long suffix after the colon (e.g. "1.2.3.4:" followed by hundreds of bytes) causes an out-of-bounds stack write whose length and contents are fully attacker-controlled (memcpy of the suffix plus a trailing NUL), enabling memory corruption and at minimum a denial of service, and potentially control-flow hijack. The parser is reached from the standard socket API (zsock_getaddrinfo / literal-address resolution), DNS server-string configuration, and the eswifi Wi-Fi co-processor DNS-response path, so an application that resolves a network-influenced address string is exposed. The bug was introduced when the parser was added (Zephyr v1.9.0) and shipped in all releases through v4.4.0. The fix removes the unbounded copy and validates the port length before copying into a small dedicated buffer. Note: the equivalent IPv6 "[addr]:port" path in parse_ipv6() retains the same unbounded copy at this commit and remains a separate, still-reachable instance of the defect.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00654 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed zephyr (zephyrproject): 4.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zephyrprojectzephyr1.9.0 to before 4.6.04.6.0Patch availableCNA
  • zephyr Vendorzephyrproject Affected 1.9.0 to before 4.6.0 Fixed in 4.6.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*1.9.0 – 3.7.2; 4.0.0 to before 4.3.1; 4.4.0 to before 4.4.1Vulnerablezephyrproject
  • cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* Versions 1.9.0 – 3.7.2; 4.0.0 to before 4.3.1; 4.4.0 to before 4.4.1 Vulnerable ·zephyrproject

Remediation

  • Fix · CNA zephyr (zephyrproject) Fixed in 4.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    zephyrproject zephyr 4.6.0

    3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-09169 SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threadsPriority HIGH 69
    • TI-2026-09166 Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)Priority MEDIUM 56
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10666
  2. 2026-10-14 EPSS moved to the 50th–90th percentile
  3. 2026-10-16 Fix available: [email protected], [email protected] · CNA
  4. 2026-11-04 Fix available: [email protected] · CNA

References

Exploit 1

Patch 2

  • TI-2026-04422 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key CVSS 3.1CRITICAL 9.8
  • TI-2026-01361 dns: memory‑safety issue in the DNS name parser CVSS 3.1CRITICAL 9.8
  • TI-2026-09174 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) CVSS 3.1CRITICAL 9.1
  • TI-2024-09625 net: lib: http_server: Buffer Under-read CVSS 3.1HIGH 8.6
  • TI-2021-02863 Usb bluetooth device ACL read cb buffer overflow CVSS 3.1CRITICAL 9.6
  • TI-2023-02095 BT HCI host union variant confusion CVSS 3.1HIGH 8.8
See all 196 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences