Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-18418— Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是对该漏洞描述信息的中文翻译： 在 中，ZBus 代理代理进程间通信（IPC）后端在记录被拒绝的域间帧（inter-domain frame）的通道名称时，使用了简单的 格式转换符。结构体 包含一个固定大小的 数组作为其最后一个成员，而传输层并未保证该数组以空字符（NUL）结尾。唯一验证终止符的代码位于 中的 函数，该函数正是在这些情况下拒绝帧的——因此，警告信息实际上在不合法的路径上打印了一个未以空字符结尾的缓冲区；对于无效的消息大小，甚至从未对该缓冲区进行检查。 任何对等域（peer domain）只要能够

CVSS 3.4 · Low

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.4.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18418

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
Source: CVE Program / CVE List V5
Vulnerability Description
The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport guarantees the array is NUL-terminated. The only code that verifies termination is zbus_proxy_agent_receive_cb() in subsys/zbus/proxy_agent/zbus_proxy_agent.c, which rejects the frame in precisely those cases — so the warning printed a non-terminated buffer exactly on the error paths where the name had been found invalid (or, for an invalid message_size, had not been inspected at all). Any peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it, by sending a frame with an out-of-range message_size or with channel_name[] containing no NUL byte. Reaching the code requires CONFIG_ZBUS_PROXY_AGENT_IPC and logging built at warning level or above (the default), and requires control over the firmware of the peer domain — typically a second core on the same SoC. The resulting strlen() inside the log packager walks past the end of the frame object until it finds a zero byte. With the icmsg backend the frame lives in a stack buffer of the IPC work-queue thread, so bytes of that thread's stack are rendered into the log message; with the rpmsg backends the scan continues through the shared vring memory. Impact is bounded to disclosure of a small amount of adjacent memory into the receiving domain's log sink, plus a possible fatal fault if the scan leaves a mapped region; the log packager's own -ENOSPC bound prevents the overrun from becoming a write. The fix bounds the conversion with %.*s and MIN(msg->channel_name_len, sizeof(msg->channel_name)).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.4.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-18418

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-18418

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-18418 (1)

Vendor Advisories for CVE-2026-18418 (1)

Same Patch Batch · zephyrproject · 2026-10-11 · 11 CVEs total

CVE-2026-19736 7.8 HIGH Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request leng
CVE-2026-19669 7.8 HIGH Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overfl
CVE-2026-19935 7.5 HIGH Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item i
CVE-2026-19577 7.1 HIGH Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer ad
CVE-2026-19576 6.8 MEDIUM Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated
CVE-2026-19740 6.5 MEDIUM Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update p
CVE-2026-19738 6.5 MEDIUM Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedure
CVE-2026-19739 6.5 MEDIUM Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives
CVE-2026-19737 5.5 MEDIUM NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
CVE-2026-19735 4.8 MEDIUM Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails sil

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-125

V. Comments for CVE-2026-18418

No comments yet

Leave a comment