CVE-2026-12630

{
  "id": "CVE-2026-12630",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-17T17:16:39.130",
  "lastModified": "2026-10-23T16:10:00.313",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC dispatch word (iphc & NET_6LO_IPHC_DA_MASK, a 4-bit value of 0-15). The reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table.\n\nThe iphc word is taken directly from the received frame, and get_ihpc_inlined_size() is reached on every inbound 6LoWPAN frame via net_6lo_uncompress() from the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee802154_6lo.c and ieee802154_6lo_fragment.c). An unauthenticated attacker on the radio/adjacent link can therefore craft a frame whose destination addressing-mode nibble selects an out-of-range index, with no privileges or user interaction.\n\nThe out-of-bounds value becomes the computed inline_size, which then drives header reconstruction before the buffer-length check: it is used to dereference *(pkt->buffer->data + sizeof(iphc) + inline_size) and to compute a size_t diff that can underflow, leading to a further out-of-bounds read of the packet buffer and malformed uncompression. The practical impact is a radio-triggerable out-of-bounds read / denial-of-service on the receiver; the leaked byte is not returned to the attacker. The fix rejects any destination index beyond the table, aborting processing of the malformed frame."
    },
    {
      "lang": "es",
      "value": "El código de descompresión de la Compresión de Cabecera IP (IPHC) 6LoWPAN de Zephyr contiene una lectura fuera de límites en get_ihpc_inlined_size() (subsys/net/ip/6lo.c). El tamaño en línea de destino se busca en da_inline_size_table, que tiene 13 entradas, utilizando un índice construido a partir de los bits M, DAC y DAM de la palabra de despacho IPHC recibida (iphc & NET_6LO_IPHC_DA_MASK, un valor de 4 bits de 0-15). Las combinaciones reservadas 13, 14 y 15 no se verifican los límites y leen más allá del final de la tabla.\n\nLa palabra iphc se toma directamente del marco recibido, y se accede a get_ihpc_inlined_size() en cada marco 6LoWPAN entrante a través de net_6lo_uncompress() desde la ruta de recepción 802.15.4 (subsys/net/l2/ieee802154/ieee802154_6lo.c e ieee802154_6lo_fragment.c). Un atacante no autenticado en el enlace de radio/adyacente puede, por lo tanto, crear un marco cuyo nibble de modo de direccionamiento de destino selecciona un índice fuera de rango, sin privilegios ni interacción del usuario.\n\nEl valor fuera de límites se convierte en el inline_size calculado, que luego impulsa la reconstrucción de la cabecera antes de la verificación de la longitud del búfer: se utiliza para desreferenciar *(pkt  ->  buffer  ->  data + sizeof(iphc) + inline_size) y para calcular una diferencia de tipo size_t que puede desbordarse por debajo, lo que lleva a una lectura adicional fuera de límites del búfer de paquetes y a una descompresión malformada. El impacto práctico es una lectura fuera de límites / denegación de servicio activable por radio en el receptor; el byte filtrado no se devuelve al atacante. La solución rechaza cualquier índice de destino más allá de la tabla, abortando el procesamiento del marco malformado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/net/ip/6lo.c"
          ],
          "versions": [
            {
              "version": "2.0.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-17T18:25:42.464908Z",
          "id": "CVE-2026-12630",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/1bbb7aefa69eaedc22281ce33aa7a2d5089d5a0e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-45c8-pmgj-6jrc",
      "source": "[email protected]"
    }
  ]
}