Zephyr Project up to 4.4.x NVS Backend settings_nvs.c out-of-bounds write

Summaryinfo

A vulnerability was found in Zephyr Project Zephyr up to 4.4.x. It has been declared as problematic. This affects the function settings_nvs_cache_match/settings_nvs_load/settings_nvs_save of the file subsys/settings/src/settings_nvs.c of the component NVS Backend. Such manipulation leads to out-of-bounds write. This vulnerability is traded as CVE-2026-12634. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Zephyr Project Zephyr up to 4.4.x. It has been rated as problematic. Affected by this issue is the function settings_nvs_cache_match/settings_nvs_load/settings_nvs_save of the file subsys/settings/src/settings_nvs.c of the component NVS Backend. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is integrity, and availability. CVE summarizes:

The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with buf[rc] = '\0', where rc is the return value of nvs_read(). Per its contract, nvs_read() returns the full stored entry length (wlk_ate.len), which can exceed the supplied buffer length — only MIN(len, stored_len) bytes are actually copied, but the return value may be much larger, bounded only by the NVS sector size. Three sites (settings_nvs_cache_match(), settings_nvs_load(), and settings_nvs_save()) used this value directly as the NUL index without clamping, so an oversized stored name entry causes a single \0 byte to be written past the end of the stack buffer at an attacker-influenced offset (CWE-787). The oversized entry cannot arise through the normal settings API, where names are bounded by SETTINGS_MAX_NAME_LEN. It requires an actor able to write the flash that backs the settings partition — a co-resident or untrusted component sharing the flash device, a malicious settings image/restore, or offline/physical flash access (a shared-flash threat model). The malformed entry is parsed when settings_load() runs at boot or subsystem init, or during settings_save(). The out-of-bounds write is a single NUL byte at an offset equal to the crafted entry length (up to the NVS sector size), so the practical impact is a crash or denial of service and limited stack corruption rather than reliable code execution. There is no confidentiality impact, and the path is not reachable from the network through the ordinary settings interface. The fix skips any entry whose nvs_read() length is greater than or equal to the buffer size before performing the NUL store.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-12634 since 06/18/2026. The exploitation is known to be easy. Local access is required to approach this attack. Additional levels of successful authentication are needed for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 4.5.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Vendor

• Zephyr Project

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion