CVE-2026-11809
Full vulnerability record from the local CVENow database.
Description
The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap. When the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path. The consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write. The fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation.
View original CVE JSON
{
"id": "CVE-2026-11809",
"sourceIdentifier": "[email protected]",
"published": "2026-08-10T21:17:18.190",
"lastModified": "2026-10-23T19:10:00.167",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe response from the UpdateHub server is copied into a heap buffer (metadata) that is correctly NUL-terminated, but a second buffer (metadata_copy) is allocated with k_malloc (unzeroed) and filled with memcpy(metadata_copy, metadata, strlen(metadata)), which omits the terminating NUL. Everything after the copied content remains uninitialized heap.\n\nWhen the first json_obj_parse() over the array descriptor fails, the code falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes through uninitialized heap and, if no zero byte is found before the end of the allocation, reads beyond the buffer; the resulting over-long length is then parsed as JSON. The probe payload is fully controlled by the (malicious, compromised, or — without the optional CONFIG_UPDATEHUB_DTLS — on-path) UpdateHub server, which can craft a large payload that fails the first parse to drive this path.\n\nThe consequence is a read of uninitialized heap, with a worst case of an out-of-bounds read past the metadata_copy allocation that can fault and crash the update thread/device, producing a network-triggerable denial of service. The over-read data is consumed only internally to evaluate the update and is not returned to the attacker, so there is no direct information disclosure and no out-of-bounds write.\n\nThe fix zeroes metadata_copy with memset before the copy, guaranteeing NUL termination and bounding strlen() within the allocation."
},
{
"lang": "es",
"value": "El cliente OTA de UpdateHub en subsys/mgmt/updatehub/updatehub.c contiene una lectura fuera de límites / de memoria no inicializada en z_impl_updatehub_probe(). La respuesta de sondeo del servidor UpdateHub se copia en un búfer de pila (metadata) que está correctamente terminado en NUL, pero un segundo búfer (metadata_copy) se asigna con k_malloc (sin inicializar a cero) y se rellena con memcpy(metadata_copy, metadata, strlen(metadata)), lo que omite el NUL de terminación. Todo lo que está después del contenido copiado permanece como pila no inicializada.\n\nCuando la primera llamada a json_obj_parse() sobre el descriptor de array falla, el código recurre a json_obj_parse(metadata_copy, strlen(metadata_copy), ...). La llamada a strlen() escanea más allá de los bytes copiados a través de la pila no inicializada y, si no se encuentra un byte cero antes del final de la asignación, lee más allá del búfer; la longitud excesiva resultante se analiza entonces como JSON. La carga útil del sondeo está totalmente controlada por el servidor UpdateHub (malicioso, comprometido o -sin el CONFIG_UPDATEHUB_DTLS opcional- en la ruta), que puede crear una carga útil grande que falle el primer análisis para impulsar esta ruta.\n\nLa consecuencia es una lectura de pila no inicializada, con un peor escenario de una lectura fuera de límites más allá de la asignación de metadata_copy que puede causar un fallo y bloquear el hilo/dispositivo de actualización, produciendo una denegación de servicio activable por red. Los datos sobre-leídos se consumen solo internamente para evaluar la actualización y no se devuelven al atacante, por lo que no hay revelación de información directa y ninguna escritura fuera de límites.\n\nLa solución pone a cero metadata_copy con memset antes de la copia, garantizando la terminación NUL y acotando strlen() dentro de la asignación."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "zephyrproject",
"product": "zephyr",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
"packageName": "zephyr",
"programFiles": [
"subsys/mgmt/updatehub/updatehub.c"
],
"versions": [
{
"version": "2.0.0",
"lessThan": "4.4.2",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 3.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-11T14:28:34.717496Z",
"id": "CVE-2026-11809",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
},
{
"lang": "en",
"value": "CWE-908"
}
]
}
],
"references": [
{
"url": "https://github.com/zephyrproject-rtos/zephyr/commit/69bbed5e601495a2076f25d822adbf991cae5c01",
"source": "[email protected]"
},
{
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6r86-hvv2-h6g4",
"source": "[email protected]"
}
]
}