PT-2026-67003 · Git+1 · Zephyr
CVE-2026-10773
·
Published
2026-08-01
·
Updated
2026-08-01
CVSS v3.1
5.4
Medium
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
(affected versions not specified)
Description
The DHCPv4 client helper function
net dhcpv4 msg type name() in subsys/net/lib/dhcpv4/dhcpv4.c contains a faulty bounds check when indexing a static 8-element name table. The check incorrectly uses sizeof(name) instead of ARRAY SIZE(name), allowing values from 9 up to the byte size of the pointer array to pass. This occurs because the msg type value is read as an unchecked raw byte from the DHCP MESSAGE TYPE option of a received packet via net pkt read u8() and passed unmodified into the lookup.An attacker or a malicious DHCP server can inject a spoofed DHCP reply to drive the index out of bounds, resulting in a wild-pointer dereference during a
%s log conversion. This issue is only triggerable when the DHCPv4 log module is built at the DEBUG level (CONFIG NET DHCPV4 LOG LEVEL DBG), which is not the default configuration. Successful exploitation can lead to a denial of service via a client crash or the disclosure of adjacent pointer contents through log output.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary mitigation, ensure the DHCPv4 log module is not built at the DEBUG level (
CONFIG NET DHCPV4 LOG LEVEL DBG).Exploit
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Zephyr