zephyrproject-rtos Zephyr up to 4.3 sockets_tls.c tls_session_store/tls_session_restore out-of-bounds write

Summaryinfo

A vulnerability, which was classified as critical, has been found in zephyrproject-rtos Zephyr up to 4.3. Affected is the function tls_session_store/tls_session_restore of the file subsys/net/lib/sockets/sockets_tls.c. The manipulation leads to out-of-bounds write. This vulnerability is documented as CVE-2026-5066. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in zephyrproject-rtos Zephyr up to 4.3 and classified as critical. This issue affects the function tls_session_store/tls_session_restore of the file subsys/net/lib/sockets/sockets_tls.c. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. struct net_sockaddr is an opaque type, so an application can pass an addrlen larger than sizeof(struct net_sockaddr) (for example 128 bytes into a 24-byte stack buffer), causing the memcpy to read and write past the end of the address memory used by the TLS session cache. This out-of-bounds write can lead to a crash and denial of service, and potentially to arbitrary code execution.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-5066 since 03/27/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34324). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• zephyrproject-rtos

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3

License

• open-source

Website

• Product: https://github.com/zephyrproject-rtos/zephyr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion