CVE-2026-11810 in Zephyr
Summary
by MITRE • 08/11/2026
The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length (objects_len != 2) and then dereferences objects[1].objects[0].objects.sha256sum via strlen() without checking that the inner object array of element [1] is non-empty.
The metadata is attacker-influenceable network input: the agent fetches it over CoAP from the configured UpdateHub server during its routine OTA probe. A malicious or compromised update server (or, when DTLS is disabled, a network man-in-the-middle) can return a response whose second outer object array is empty. Because the parse target is zero-initialised, the corresponding objects[1].objects[0].objects.sha256sum pointer is NULL, and the subsequent strlen() dereferences address zero. The same defect exists in both the 'any boards' and 'some boards' metadata layouts.
The resulting CPU fault is fatal under Zephyr's default error handling, halting or resetting the device, so the flaw is a remotely triggerable denial of service. Impact is limited to availability; it is a read from NULL with no out-of-bounds write, memory corruption, or information disclosure. The fix rejects metadata whose inner object array is empty before any dereference, on both layouts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability exists within the UpdateHub firmware-update agent's probe handler implementation in Zephyr-based systems, specifically in the z_impl_updatehub_probe() function located in subsys/mgmt/updatehub/updatehub.c. This flaw represents a classic null pointer dereference that occurs during JSON metadata parsing from remote update servers. The system processes JSON responses containing fixed two-level nested arrays but fails to validate the integrity of the inner array structure before attempting to access its elements.
The technical implementation defect stems from incomplete validation logic where only the outer array length is verified through objects_len != 2 check, while the inner array structure remains unvalidated. During normal operation, the agent fetches metadata over CoAP protocol from configured UpdateHub servers as part of routine OTA probe procedures. When DTLS encryption is disabled or when the update server becomes compromised, attackers can manipulate the response to include an empty second outer object array, specifically objects[1] which should contain the expected inner structure.
This vulnerability manifests when the parser encounters a metadata response where objects[1].objects[0].objects.sha256sum pointer points to address zero due to zero-initialization of the target structure. The subsequent strlen() operation attempts to dereference this null pointer, resulting in immediate CPU fault conditions under Zephyr's default error handling mechanisms. The flaw affects both metadata layouts - 'any boards' and 'some boards' - indicating it is a fundamental structural issue rather than layout-specific.
The operational impact of this vulnerability constitutes a remotely triggerable denial of service condition that can halt or reset the affected device completely. According to CWE classification, this represents a CWE-476: NULL Pointer Dereference vulnerability where the system fails to validate pointer values before dereferencing them. The ATT&CK framework categorizes this under T1499.004: Endpoint Denial of Service, specifically targeting device availability through manipulation of network input data.
The root cause lies in the insufficient bounds checking and null validation during JSON parsing operations. The fix requires implementing pre-dereference validation that rejects metadata containing empty inner object arrays before any pointer access occurs. This approach aligns with secure coding practices and defensive programming principles to prevent unauthorized exploitation. The vulnerability affects all devices running the affected firmware-update agent where DTLS is either disabled or can be bypassed, making it particularly concerning for IoT deployments where network security may be compromised.