CVE-2026-18747 in Zephyr
Summary
by MITRE • 09/29/2026
The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips the trailing CRC with rx_ctxt->nb->len -= 2U; in mcumgr_serial_process_frag() (subsys/mgmt/mcumgr/transport/src/serial_util.c). mcumgr_serial_extract_len() accepted any declared length, including 0 and 1, and a packet declaring length 0 passes the checksum test for free because crc16_itu_t() over zero bytes returns the zero seed. Since net_buf::len is a uint16_t, the subtraction underflows and the buffer is handed to SMP claiming roughly 65 KB of payload while its data area is only CONFIG_MCUMGR_TRANSPORT_NETBUF_SIZE bytes (default 384).
The trigger is a single unauthenticated 7-byte line on the management console — the 0x06 0x09 packet marker followed by the base64 group AAA= and a newline — delivered to any transport built on this helper: CONFIG_MCUMGR_TRANSPORT_UART (smp_uart.c) or CONFIG_MCUMGR_TRANSPORT_SHELL (smp_shell.c), both of which select MCUMGR_TRANSPORT_SERIAL_HAS_SMP_OVER_CONSOLE. No prior session state, fragmentation or credentials are required to trigger the underflow, and the malformed frame is mishandled before any command handler or command-level access control runs. The attacker only needs write access to that console, which on many boards is a USB CDC-ACM port rather than a bare UART header.
With the inflated length, smp_process_request_packet() in subsys/mgmt/mcumgr/smp/src/smp.c loses its bound: cbor_nb_reader_init() gives the CBOR decoder a ~65 KB window into a 384-byte buffer, and each request header's nh_len is checked only against the inflated length. On its own the 7-byte frame re-parses whatever stale bytes the reused pool buffer still holds, typically a replay of the previously received request followed by a parse error, without leaving the buffer. Because the transport is unauthenticated, though, the attacker also controls the frames sent before the trigger, and can stage buffer contents so that a request succeeds with an nh_len larger than the buffer; net_buf_pull(), guarded only by __ASSERT_NO_MSG, then moves the parse cursor out of bounds and the loop reads further headers and CBOR from adjacent memory. The consequence is an out-of-bounds read that can fault the MCUmgr thread (denial of service); memory disclosure is also possible, since the default-enabled os echo handler (CONFIG_MCUMGR_GRP_OS_ECHO) decodes its string inside that window and copies it into its response. There is no integrity gain beyond what the unauthenticated transport already permits.
The fix rejects any declared packet length of two bytes or fewer in mcumgr_serial_extract_len(), so the CRC-strip subtraction can no longer underflow. The identical pattern remains in the test-only loopback transport subsys/mgmt/mcumgr/transport/src/smp_dummy.c (CONFIG_MCUMGR_TRANSPORT_DUMMY), which has no external input path and therefore carries no practical exposure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability resides within the MCUmgr SMP-over-console transport implementation, specifically in the serial utility module responsible for processing fragmented packets. The core technical flaw is an integer underflow that occurs during the validation of packet length fields. When a base64-encoded frame is decoded, the system reads a 16-bit packet length and verifies its cyclic redundancy check before attempting to strip the trailing CRC bytes from the buffer's length counter by subtracting two. This operation assumes that the declared payload length is strictly greater than two bytes. However, the extraction function accepts any valid unsigned integer value for the length field, including zero or one. Because a packet declaring a length of zero passes the checksum verification trivially—the cyclic redundancy check over an empty data set returns the initial seed value—an attacker can craft a malformed frame that triggers this condition. When the system attempts to subtract two from a buffer length that is less than two, the unsigned integer underflows, resulting in a massive positive value close to sixty-five kilobytes due to the properties of sixteen-bit arithmetic.
This underflow has severe operational consequences because it decouples the logical payload size from the actual physical capacity of the network buffer. The underlying net_buf structure typically holds only three hundred and eighty-four bytes by default, yet the subsequent processing logic operates on the inflated sixty-five kilobyte length. In the SMP request processing routine, this discrepancy allows a CBOR decoder to initialize with an excessively large read window relative to the actual data available. While a single malformed packet might initially result in reading stale memory from previously reused buffer pools without immediate exploitation, the vulnerability becomes critical when combined with attacker-controlled prior state. Since the transport is unauthenticated and requires no session establishment or credentials, an adversary can stage multiple frames. By carefully controlling the contents of preceding buffers, an attacker can ensure that a subsequent request header claims a length larger than the physical buffer size. The parsing loop then proceeds to read beyond the allocated memory boundaries into adjacent kernel memory spaces.
The impact of this vulnerability includes denial of service and potential information disclosure. If the out-of-bounds read accesses invalid memory pages or triggers hardware exceptions, it can crash the MCUmgr thread, effectively disabling management capabilities on the device. Furthermore, because certain handlers such as the OS echo handler decode strings within this oversized window before copying them to responses, an attacker may be able to exfiltrate sensitive data from adjacent kernel memory regions that were not intended for exposure. The attack vector is particularly dangerous given its simplicity; it requires only a single seven-byte line delivered via write access to the management console. On many embedded platforms, this interface corresponds to a USB CDC-ACM port rather than a physical UART header, significantly lowering the barrier to entry for remote exploitation over standard serial connections.
Mitigation strategies focus on enforcing strict bounds checking during the initial packet length validation phase. The primary fix involves rejecting any declared packet length that is two bytes or fewer in the extraction function, thereby preventing the subsequent subtraction from underflowing and ensuring the buffer length remains consistent with actual data availability. This change ensures that malformed frames are discarded before they can influence downstream parsing logic. Additionally, developers should review other transport implementations for similar patterns of unchecked integer arithmetic when manipulating buffer lengths based on external inputs. While some internal test transports may exhibit identical code structures, they generally lack external input paths and thus do not present a practical attack surface unless exposed to untrusted networks. Regular auditing of memory management routines in embedded systems is essential to prevent such underflow vulnerabilities from compromising system integrity.