PT-2026-45078 · Zephyrproject Rtos · Zephyr

Published 2026-05-30 · Updated 2026-05-30 · CVE-2026-5071

Mitre

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan frame object using only a NET ASSERT statement in zcan sendto ctx() before dereferencing it in socketcan to can frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan to can frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-5071

Affected Products

Zephyr

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-5071 · Security Note
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3w6-x7m3-3c58 · Note