Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-126957— ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c

Quick assessment

Affected
zephyrproject-rtos Zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zephyr 的 IPv4 选项处理中存在整数下溢漏洞，允许远程未认证攻击者读取栈内存。当回复携带 IPv4“记录路由”（Record Route）或“时间戳”（Timestamp）选项的 ICMP Echo 请求时， 中的 和 函数使用 算术运算，通过 计算已记录数据的长度。攻击者可控制的“指针”字段仅被检查是否小于选项长度，却未验证其是否满足 RFC 791 规定的最小值（记录路由为 4，时间戳为 5）。因此，若该值过小，会导致长度计算发生回绕（wrap around），最大可达 252 字节。随后， 会读取超

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-126957

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c
Source: CVE Program / CVE List V5
Vulnerability Description
An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject-rtos Zephyr * ~ 4.4.0 -

II. Public POCs for CVE-2026-126957

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-126957

请登录查看更多情报信息。

Other References for CVE-2026-126957 (1)

IV. Related Vulnerabilities

Same product: Zephyr
Same vendor: zephyrproject-rtos
Same weakness: CWE-125