Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-12630— 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zephyr是Zephyr组织开源的一款面向物联网的实时操作系统。 Zephyr 2.0.0版本至4.4.2之前版本存在缓冲区错误漏洞，该漏洞源于6LoWPAN IPHC解压缩代码中的get_ihpc_inlined_size()函数在查表时未对保留索引13、14、15进行边界检查，导致越界读取，可能造成拒绝服务。

CVSS 4.3 · Medium EPSS 0.17% · P7

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 2.0.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12630

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode
Source: CVE Program / CVE List V5
Vulnerability Description
Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC dispatch word (iphc & NET_6LO_IPHC_DA_MASK, a 4-bit value of 0-15). The reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table. The iphc word is taken directly from the received frame, and get_ihpc_inlined_size() is reached on every inbound 6LoWPAN frame via net_6lo_uncompress() from the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee802154_6lo.c and ieee802154_6lo_fragment.c). An unauthenticated attacker on the radio/adjacent link can therefore craft a frame whose destination addressing-mode nibble selects an out-of-range index, with no privileges or user interaction. The out-of-bounds value becomes the computed inline_size, which then drives header reconstruction before the buffer-length check: it is used to dereference *(pkt->buffer->data + sizeof(iphc) + inline_size) and to compute a size_t diff that can underflow, leading to a further out-of-bounds read of the packet buffer and malformed uncompression. The practical impact is a radio-triggerable out-of-bounds read / denial-of-service on the receiver; the leaked byte is not returned to the attacker. The fix rejects any destination index beyond the table, aborting processing of the malformed frame.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
Zephyr 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Zephyr是Zephyr组织开源的一款面向物联网的实时操作系统。 Zephyr 2.0.0版本至4.4.2之前版本存在缓冲区错误漏洞，该漏洞源于6LoWPAN IPHC解压缩代码中的get_ihpc_inlined_size()函数在查表时未对保留索引13、14、15进行边界检查，导致越界读取，可能造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 2.0.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-12630

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-12630

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-12630 (1)

Vendor Advisories for CVE-2026-12630 (1)

Same Patch Batch · zephyrproject · 2026-08-17 · 4 CVEs total

CVE-2026-9771 8.8 HIGH Missing device-pointer validation in flash_copy() syscall allows userspace privilege escal
CVE-2026-12519 5.0 MEDIUM Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing
CVE-2026-12629 4.6 MEDIUM PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denia

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-125

V. Comments for CVE-2026-12630

No comments yet

Leave a comment