{"id":"CVE-2026-126957","kind":"vulnerability","aliases":["CVE-2026-126957"],"related":[],"title":"Zephyr: crafted ICMP ping leaks device stack memory to attacker","description":"An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.","summary":"Zephyr's IPv4 handling of Record Route and Timestamp options computes a wrapped length when a crafted Pointer field is too small, so the ICMP Echo Reply includes up to 213 bytes of stack memory. A remote attacker needs only one unauthenticated ping packet, and the device does not crash, so the leak can be repeated.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iot","ipv4","runtime","zephyr"],"not_affected_if":["default-config"],"how_to_check":"- Check whether the firmware is built with `CONFIG_NET_IPV4_HDR_OPTIONS` enabled, directly or through `CONFIG_NET_IPV4_IGMP`.\n- Check the Zephyr version in use against the product ranges, which the sources do not state: unknown.","fix":null,"status":"open","published_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:49+00:00","updated_at":"2026-11-12T03:47:49+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T03:47:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zephyr: crafted ICMP ping leaks device stack memory to attacker","impact":"medium","summary":"Zephyr's IPv4 handling of Record Route and Timestamp options computes a wrapped length when a crafted Pointer field is too small, so the ICMP Echo Reply includes up to 213 bytes of stack memory. A remote attacker needs only one unauthenticated ping packet, and the device does not crash, so the leak can be repeated.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","iot","ipv4"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Stack memory, including pointers, leaks to remote attacker","analyst_note":"Find the fixed Zephyr version and any workaround in the NVD entry or the vendor advisory listed under linked pages.","how_to_check":"- Check whether the firmware is built with `CONFIG_NET_IPV4_HDR_OPTIONS` enabled, directly or through `CONFIG_NET_IPV4_IGMP`.\n- Check the Zephyr version in use against the product ranges, which the sources do not state: unknown.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Devices running Zephyr's IPv4 stack with header options enabled, which CONFIG_NET_IPV4_IGMP selects, are exposed to any host that can send them an ICMP Echo Request. The sources do not give fixed versions or a workaround. Systems that do not build with IPv4 header options can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000792,"input_tokens":4854,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126957':13A,16A '-2026':12A,15A '213':52B,193C '252':175C '4':158C '40':184C '5':162C '791':156C 'affect':244C 'allow':87C 'alreadi':128C 'arithmet':138C 'attack':10A,59B,91C,141C 'attacker-control':140C 'buffer':189C 'built':230C 'byte':53B,176C,185C,194C 'carri':104C 'check':146C 'comput':32B,123C 'config':232C,238C 'control':142C 'craft':2A,38B 'crash':71B,223C 'cve':11A,14A 'data':130C,187C 'devic':6A,68B,220C,229C 'echo':47B,101C,210C 'embed':17B 'field':40B,144C 'handl':25B,86C 'hdr':235C 'heap':203C 'icmp':3A,46B,100C,209C 'icmpv4':112C,117C 'igmp':241C 'includ':49B,200C 'integ':79C 'iot':18B 'ipv4':19B,24B,84C,106C,234C,240C 'leak':5A,74B,217C 'length':35B,125C,150C,171C 'memori':8A,56B,95C,197C 'minimum':157C 'need':60B 'net':177C,233C,239C 'offset':134C 'one':62B 'opt':186C 'option':31B,85C,111C,149C,236C 'packet':65B,214C 'past':182C 'ping':4A,64B 'pkt':178C 'pointer':39B,143C,204C 'ptr':132C,133C 'read':93C,181C 'record':27B,107C,114C,129C,160C 'remot':58B,89C 'repeat':77B,228C 'repli':48B,97C,211C 'request':102C 'return':206C 'rfc':155C 'rout':28B,108C,115C,161C 'runtim':20B 'select':242C 'singl':213C 'small':43B 'smaller':167C 'stack':7A,55B,94C,188C,196C,201C 'stamp':120C 'subsys/net/ip/icmpv4.c':122C 'time':119C 'timestamp':30B,110C,164C 'trigger':215C 'uint8':136C 'unauthent':63B,90C 'underflow':80C 'updat':113C,118C 'valu':168C 'wrap':34B,169C 'write':179C 'zephyr':1A,21B,22B,82C","nicknames":[],"mitigations":[],"who_affected":"Devices running Zephyr's IPv4 stack with header options enabled, which CONFIG_NET_IPV4_IGMP selects, are exposed to any host that can send them an ICMP Echo Request. The sources do not give fixed versions or a workaround. Systems that do not build with IPv4 header options can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","iot","ipv4","medium","runtime","zephyr"],"campaign_type":null,"search_a":"'-126957':13A,16A '-2026':12A,15A 'attack':10A 'craft':2A 'cve':11A,14A 'devic':6A 'icmp':3A 'leak':5A 'memori':8A 'ping':4A 'stack':7A 'zephyr':1A","search_b":"'213':52B 'attack':59B 'byte':53B 'comput':32B 'craft':38B 'crash':71B 'devic':68B 'echo':47B 'embed':17B 'field':40B 'handl':25B 'icmp':46B 'includ':49B 'iot':18B 'ipv4':19B,24B 'leak':74B 'length':35B 'memori':56B 'need':60B 'one':62B 'option':31B 'packet':65B 'ping':64B 'pointer':39B 'record':27B 'remot':58B 'repeat':77B 'repli':48B 'rout':28B 'runtim':20B 'small':43B 'stack':55B 'timestamp':30B 'unauthent':63B 'wrap':34B 'zephyr':21B,22B","search_c":"'213':193C '252':175C '4':158C '40':184C '5':162C '791':156C 'affect':244C 'allow':87C 'alreadi':128C 'arithmet':138C 'attack':91C,141C 'attacker-control':140C 'buffer':189C 'built':230C 'byte':176C,185C,194C 'carri':104C 'check':146C 'comput':123C 'config':232C,238C 'control':142C 'crash':223C 'data':130C,187C 'devic':220C,229C 'echo':101C,210C 'field':144C 'handl':86C 'hdr':235C 'heap':203C 'icmp':100C,209C 'icmpv4':112C,117C 'igmp':241C 'includ':200C 'integ':79C 'ipv4':84C,106C,234C,240C 'leak':217C 'length':125C,150C,171C 'memori':95C,197C 'minimum':157C 'net':177C,233C,239C 'offset':134C 'opt':186C 'option':85C,111C,149C,236C 'packet':214C 'past':182C 'pkt':178C 'pointer':143C,204C 'ptr':132C,133C 'read':93C,181C 'record':107C,114C,129C,160C 'remot':89C 'repeat':228C 'repli':97C,211C 'request':102C 'return':206C 'rfc':155C 'rout':108C,115C,161C 'select':242C 'singl':213C 'smaller':167C 'stack':94C,188C,196C,201C 'stamp':120C 'subsys/net/ip/icmpv4.c':122C 'time':119C 'timestamp':110C,164C 'trigger':215C 'uint8':136C 'unauthent':90C 'underflow':80C 'updat':113C,118C 'valu':168C 'wrap':169C 'write':179C 'zephyr':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T02:22:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126957","severity":null,"published_at":"2026-11-12T03:17:11+00:00","modified_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null}],"documents":[{"id":131426,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cvv6-5f6x-87qf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-12T02:22:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}