AIKIDO-2026-966746
zephyrproject-rtos.zephyr is vulnerable to Out-of-bounds Write
84
High Risk
This Affects:
zephyrproject-rtos.zephyrTL;DR
Zephyr's TLS/DTLS socket layer exposes the negotiated peer Connection ID through a getsockopt option. The handler passes without checking that it is at least the maximum Connection ID length, so it can be written past the end of an undersized buffer. When userspace support is enabled, an unprivileged thread can request an exact-sized buffer and corrupt adjacent heap memory. The fix validates the caller-provided option length against the required maximum before copying the Connection ID.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use DTLS sockets with the peer Connection ID feature enabled and read the negotiated peer Connection ID through the corresponding getsockopt option.
Background info
zephyrproject-rtos.zephyr is vulnerable to Out-of-bounds Write in versions 3.5.0 - 4.4.0.
How to fix this
Upgrade the zephyrproject-rtos.zephyr library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant