---
id: "CVE-2026-126957"
page: "https://infrastack.ai/live/CVE-2026-126957"
kind: "vulnerability"
aliases: ["CVE-2026-126957"]
title: "Zephyr: crafted ICMP ping leaks device stack memory to attacker"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "iot", "ipv4", "runtime", "zephyr"]
not_affected_if: ["default-config"]
published_at: "2026-11-12T03:17:11+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:47:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126957", "first_seen_at": "2026-11-12T03:46:13+00:00"}]
exploit_sources: []
---

# Zephyr: crafted ICMP ping leaks device stack memory to attacker

Link for people: https://infrastack.ai/live/CVE-2026-126957 (this .md is for agents)

Zephyr's IPv4 handling of Record Route and Timestamp options computes a wrapped length when a crafted Pointer field is too small, so the ICMP Echo Reply includes up to 213 bytes of stack memory. A remote attacker needs only one unauthenticated ping packet, and the device does not crash, so the leak can be repeated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the firmware is built with `CONFIG_NET_IPV4_HDR_OPTIONS` enabled, directly or through `CONFIG_NET_IPV4_IGMP`.
- Check the Zephyr version in use against the product ranges, which the sources do not state: unknown.

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126957

## Documents

- [advisory] Vendor advisory: github.com https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cvv6-5f6x-87qf

## From the sources

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_