Zephyr OS: Four Vulnerabilities Disclosed, Including Heap Overflow and Bluetooth Flaws
Four vulnerabilities affecting Zephyr OS's device management and Bluetooth stack were disclosed between July 31 and August 3, 2026, with two rated High severity.
Key findings
- Four vulnerabilities in Zephyr OS disclosed between July 31 and August 3, 2026, impacting device management and Bluetooth.
- High severity flaws include a heap buffer overflow in the hawkBit client (CVE-2026-10849) and a GATT client callback issue (CVE-2026-10685).
- Medium severity vulnerability in Bluetooth GATT characteristic declaration (CVE-2026-2411).
- Low severity issue involves a Bluetooth Mesh key slot leak on subnet key teardown (CVE-2026-10774).
- Users should consult official Zephyr OS advisories for patching and mitigation details.
On August 3, 2026, a batch of four vulnerabilities affecting Zephyr OS was disclosed, spanning a disclosure window from July 31 to August 3. These vulnerabilities impact various components of the real-time operating system, including its device management client and Bluetooth stack. The disclosures highlight potential security weaknesses in how Zephyr handles network responses, key management, GATT characteristics, and Bluetooth client callbacks.
One of the more critical issues, CVE-2026-10849, identified as High severity with a CVSSv3 score of 8.2, resides in the hawkBit device management client. The vulnerability occurs in the response_json_cb() function within subsys/mgmt/hawkbit/hawkbit.c. Here, the client accumulates HTTP response bodies from the update server into a heap buffer. Crucially, the buffer is sized to hold the data but lacks space for a terminating null character. This can lead to a buffer overflow when the full response is processed, potentially allowing for code execution or denial of service.
Another High severity vulnerability, CVE-2026-10685 (CVSSv3 7.6), affects the Zephyr Bluetooth GATT client. Specifically, the gatt_write_ccc_rsp() function in subsys/bluetooth/host/gatt.c handles CCC-write responses. The vulnerability arises from the order of operations: the application's params->subscribe() callback is invoked *after* params->notify() has already been called with NULL data. According to the public GATT API, a NULL data notification callback signifies the end of a subscription, making the subsequent subscribe() call redundant and potentially leading to unexpected behavior or security issues.
A Medium severity vulnerability, CVE-2026-2411 (CVSSv3 6.5), concerns the declaration of GATT characteristics within Zephyr's Bluetooth host. A GATT characteristic is declared as two consecutive attributes: a Characteristic Declaration with read permissions hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that should inherit application-specified security permissions. This misconfiguration could lead to unintended access or denial of service if the read permission on the declaration is not aligned with the intended security of the characteristic value.
Lastly, a Low severity vulnerability, CVE-2026-10774 (CVSSv3 2.4), impacts Zephyr's Bluetooth Mesh subnet key management. The net_keys_create() function in subsys/bluetooth/mesh/subnet.c imports the Private Beacon Key into a PSA crypto key slot. However, the corresponding psa_destroy() call within subnet_keys_destroy() is not properly guarded when CONFIG_BT_MESH_PRIV_BEACONS is enabled, leading to a leak of one PSA Crypto key slot with every subnet-key teardown. While low in severity, this could contribute to resource exhaustion over time.
The disclosed vulnerabilities require users of Zephyr OS to update their systems to patched versions. Specific version information for the fixes was not detailed in the disclosures, but users should consult the official Zephyr OS advisories for the latest information and mitigation strategies. Addressing these issues is crucial for maintaining the security and integrity of IoT devices running on the Zephyr RTOS.
The batch of vulnerabilities underscores the importance of rigorous security auditing across all components of an operating system, particularly in embedded and IoT environments where security is paramount. Users are advised to apply patches promptly and stay informed about future security updates from the Zephyr OS project.