Read the docs
TI-2026-10193 Aliases CVE-2026-11810

NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

Priority LOW 39CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length (objects_len != 2) and then dereferences objects[1].objects[0].objects.sha256sum via strlen() without checking that the inner object array of element [1] is non-empty. The metadata is attacker-influenceable network input: the agent fetches it over CoAP from the configured UpdateHub server during its routine OTA probe. A malicious or compromised update server (or, when DTLS is disabled, a network man-in-the-middle) can return a response whose second outer object array is empty. Because the parse target is zero-initialised, the corresponding objects[1].objects[0].objects.sha256sum pointer is NULL, and the subsequent strlen() dereferences address zero. The same defect exists in both the 'any boards' and 'some boards' metadata layouts. The resulting CPU fault is fatal under Zephyr's default error handling, halting or resetting the device, so the flaw is a remotely triggerable denial of service. Impact is limited to availability; it is a read from NULL with no out-of-bounds write, memory corruption, or information disclosure. The fix rejects metadata whose inner object array is empty before any dereference, on both layouts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Fix Fixed zephyr (zephyrproject): 4.3.2, 4.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zephyrprojectzephyr3.7.0 to before 4.3.2; 4.4.0 to before 4.4.24.3.2, 4.4.2Patch availableCNA
  • zephyr Vendorzephyrproject Affected 3.7.0 to before 4.3.2; 4.4.0 to before 4.4.2 Fixed in 4.3.2, 4.4.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*——zephyrproject
  • cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* Versions — — ·zephyrproject

Remediation

  • Fix · CNA zephyr (zephyrproject) Fixed in 4.3.2, 4.4.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    zephyrproject zephyr 4.3.2, 4.4.2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-10194 Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoSPriority LOW 18
    • TI-2026-10192 UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadataPriority LOW 18
    • TI-2026-10195 UpdateHub: race condition on shared context causes out-of-bounds write and DoSPriority LOW 12
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11810
  2. 2026-11-04 Fix available: [email protected] · CNA

References

Patch 1

Other 1

  • TI-2026-04422 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key CVSS 3.1CRITICAL 9.8
  • TI-2026-01361 dns: memory‑safety issue in the DNS name parser CVSS 3.1CRITICAL 9.8
  • TI-2026-09174 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) CVSS 3.1CRITICAL 9.1
  • TI-2026-09168 Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c` CVSS 3.1CRITICAL 9.8
  • TI-2024-09625 net: lib: http_server: Buffer Under-read CVSS 3.1HIGH 8.6
  • TI-2021-02863 Usb bluetooth device ACL read cb buffer overflow CVSS 3.1CRITICAL 9.6
See all 341 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences