Zephyr Project: Five Network and Modem Driver Flaws Disclosed Together
Five vulnerabilities affecting Zephyr Project's networking and modem drivers were disclosed August 17-19, 2026, with High and Medium severity ratings.
Key findings
- Five vulnerabilities disclosed in Zephyr Project between August 17-19, 2026, affecting networking and modem components.
- High severity flaws (CVSS 8.1, 8.8) include integer overflow in IPv6 neighbor discovery and buffer overflow in HL7800 modem driver.
- Medium severity issues involve buffer overflows in HL7800 and WNC-M14A2A modem drivers, and interrupt handling errors in ARM PL011 UART driver.
- Vulnerabilities primarily stem from improper handling of network data and modem responses, requiring careful input validation.
- Users are advised to update to the latest Zephyr Project versions to patch these vulnerabilities.
On August 17-19, 2026, a batch of five vulnerabilities was disclosed in the Zephyr Project, an open-source real-time operating system. These vulnerabilities, spanning high and medium severity ratings, primarily affect network-related components and modem drivers, potentially exposing embedded systems to denial-of-service or information disclosure attacks. The disclosures highlight issues in how the Zephyr Project handles network packet processing and modem communication, underscoring the need for careful validation of external inputs in IoT and embedded environments.
Two of the disclosed vulnerabilities, CVE-2026-12633 and CVE-2026-12522, stem from improper handling of network data. CVE-2026-12633, rated High with a CVSS score of 8.1, resides in the IPv6 neighbor-discovery code. It involves an integer overflow vulnerability where the 8-bit context length field from 6LoWPAN Context Option (6CO) in ICMPv6 Router Advertisements is not bounded by its RFC maximum of 128, potentially leading to buffer overflows or denial-of-service conditions. Similarly, CVE-2026-12522, a High severity vulnerability (CVSS 8.8), affects the HL7800 cellular modem driver. It involves a flaw in parsing the PDP-context dynamic parameters, where the response is linearized into a 256-byte buffer without proper length checks, creating a risk of buffer overflows.
Further vulnerabilities were found in modem drivers and serial communication. CVE-2026-12520, a Medium severity issue (CVSS 6.4), also impacts the Sierra Wireless HL7800 cellular modem driver. This vulnerability arises from a buffer overflow when parsing AT responses, where data is linearized into a 128-byte stack buffer. The function net_buf_linearize() caps the copy at 128 bytes, but subsequent processing writes beyond this buffer if out_len exceeds the allocated space. CVE-2026-12519, another Medium severity vulnerability (CVSS 5.0), affects the WNC-M14A2A LTE-M modem driver. It concerns the mishandling of unsolicited %NOTIFYEV: events, where the response is linearized into a fixed 40-byte buffer, but the processing logic can lead to out-of-bounds writes. Lastly, CVE-2026-12629, a Medium severity vulnerability (CVSS 4.6), is found in the ARM PL011 UART driver. This flaw lies in the failure to properly acknowledge receive error interrupts, which could lead to missed error conditions or system instability.
The disclosed vulnerabilities were addressed by the Zephyr Project team. While specific patch versions were not detailed in the disclosures, users are advised to update to the latest available versions of the Zephyr Project to mitigate these risks. The affected components range from core networking stacks to specific hardware drivers, indicating a broad impact across different system configurations.
These vulnerabilities collectively highlight the importance of robust input validation and secure memory handling practices within embedded operating systems like Zephyr. Developers integrating these systems must be vigilant about the data processed from network interfaces and peripheral devices. The timely disclosure and subsequent patching of these issues by the Zephyr Project team are crucial for maintaining the security and reliability of connected devices. Users should prioritize applying updates to protect their systems from potential exploitation.