Zephyr Project up to 4.4.1 Zbus Proxy Agent IPC Backend zbus_proxy_agent_ipc.c zbus_proxy_agent_receive_cb channel_name_len out-of-bounds

Summaryinfo

A vulnerability was found in Zephyr Project Zephyr up to 4.4.1. It has been classified as problematic. This affects the function zbus_proxy_agent_receive_cb of the file subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c of the component Zbus Proxy Agent IPC Backend. This manipulation of the argument channel_name_len causes out-of-bounds. This vulnerability appears as CVE-2026-18418. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Zephyr Project Zephyr up to 4.4.1. It has been declared as problematic. Affected by this vulnerability is the function zbus_proxy_agent_receive_cb of the file subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c of the component Zbus Proxy Agent IPC Backend. The manipulation of the argument channel_name_len with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport guarantees the array is NUL-terminated. The only code that verifies termination is zbus_proxy_agent_receive_cb() in subsys/zbus/proxy_agent/zbus_proxy_agent.c, which rejects the frame in precisely those cases — so the warning printed a non-terminated buffer exactly on the error paths where the name had been found invalid (or, for an invalid message_size, had not been inspected at all). Any peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it, by sending a frame with an out-of-range message_size or with channel_name[] containing no NUL byte. Reaching the code requires CONFIG_ZBUS_PROXY_AGENT_IPC and logging built at warning level or above (the default), and requires control over the firmware of the peer domain — typically a second core on the same SoC. The resulting strlen() inside the log packager walks past the end of the frame object until it finds a zero byte. With the icmsg backend the frame lives in a stack buffer of the IPC work-queue thread, so bytes of that thread's stack are rendered into the log message; with the rpmsg backends the scan continues through the shared vring memory. Impact is bounded to disclosure of a small amount of adjacent memory into the receiving domain's log sink, plus a possible fatal fault if the scan leaves a mapped region; the log packager's own -ENOSPC bound prevents the overrun from becoming a write. The fix bounds the conversion with %.*s and MIN(msg->channel_name_len, sizeof(msg->channel_name)).

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-18418 since 07/30/2026. The exploitation appears to be easy. Attacking locally is a requirement. Additional levels of successful authentication are necessary for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.4.2 eliminates this vulnerability. Applying the patch fc065f79a568a6c6cc14b89795bd60e5eabd6f02 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• Zephyr Project

Name

• Zephyr

Version

• 4.4.0
• 4.4.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion