Zephyr RTOS: Critical Stack Overflow and Two Medium Flaws Disclosed Together
Zephyr RTOS faces a critical stack buffer overflow (CVE-2026-13214) and two medium vulnerabilities disclosed August 24-25, 2026.
Key findings
- Critical CVE-2026-13214: Stack buffer overflow in OCPP 1.6 client with CVSSv3 9.8.
- Two medium-severity vulnerabilities disclosed: CVE-2026-9728 (syscall verifier) and CVE-2026-13343 (UMP Stream responder).
- Vulnerabilities affect networking, IPC, and message handling components of Zephyr RTOS.
- Disclosed together over a 14-hour window between August 24-25, 2026.
On August 24-25, 2026, a critical vulnerability and two medium-severity flaws were disclosed in the Zephyr Project's real-time operating system. The most severe of these, CVE-2026-13214, is a stack buffer overflow in the OCPP 1.6 client's handling of GetConfiguration requests. This vulnerability, rated Critical with a CVSSv3 score of 9.8, could allow an attacker to overwrite adjacent memory on the stack by sending a crafted "key" string.
Two other vulnerabilities were disclosed on August 24, 2026. CVE-2026-9728, a medium-severity flaw (CVSSv3 6.4), exists in the userspace syscall verifier z_vrfy_mbox_send() within the mbox driver. This function improperly validated nested message fields by reading directly from live userspace memory, forwarding a mutable pointer to the underlying driver. The second medium-severity issue, CVE-2026-13343 (CVSSv3 5.3), resides in the UMP Stream responder library's handling of MIDI 2.0 Universal MIDI Packets. Specifically, the make_endpoint_info() and make_function_block_info() functions did not fully populate reply packets, potentially leading to issues when processing these incomplete structures.
The disclosed vulnerabilities affect specific components within the Zephyr RTOS, including its networking stack (OCPP client) and inter-process communication mechanisms (mbox, MIDI 2.0). The critical nature of CVE-2026-13214 highlights the importance of secure handling of external input, particularly in network-facing services. While CVE-2026-13343 and CVE-2026-9728 are rated medium, they indicate potential weaknesses in data handling and system call verification that could be chained with other vulnerabilities or exploited under specific conditions.
Details regarding specific affected versions and patches are not provided in the initial disclosure information. Users of the Zephyr Project are advised to monitor official advisories for updates and recommended mitigation strategies. The coordinated disclosure of these vulnerabilities within a short timeframe underscores the ongoing efforts to identify and address security weaknesses in embedded operating systems.
This batch of vulnerabilities serves as a reminder for developers utilizing the Zephyr RTOS to maintain vigilance regarding security updates and to implement robust input validation and secure coding practices, especially when dealing with network protocols and inter-component communication. Further analysis may reveal specific exploitation vectors or impact scenarios for each CVE.