Kernel memory corruption via unbounded payload copy
Published Mar 27, 2026 · Updated Mar 27, 2026
Buffer overflow in Zephyr RTOS 4.3 and earlier allows local users to corrupt kernel memory through an oversized eswifi socket send. The eswifi_socket_send function appends the caller-controlled payload to the fixed eswifi->buf staging buffer with memcpy without checking the header-adjusted remaining capacity. Local code able to invoke the socket offload send path can crash the device or potentially execute code in the kernel context; network traffic alone cannot trigger the flaw.
Summary
What happened
Buffer overflow in Zephyr RTOS 4.3 and earlier allows local users to corrupt kernel memory through an oversized eswifi socket send. The eswifi_socket_send function appends the caller-controlled payload to the fixed eswifi->buf staging buffer with memcpy without checking the header-adjusted remaining capacity. Local code able to invoke the socket offload send path can crash the device or potentially execute code in the kernel context; network traffic alone cannot trigger the flaw.
The record
- CVE
- CVE-2026-1679
- Published
- Mar 27, 2026
- Updated
- Mar 27, 2026
- Vendor
- Zephyr Project
- Product
- Zephyr RTOS
- Classifications
- CWE-120, T1499.004
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- Mar 27, 2026CVE publishedPublication date reported by the CVE source.
- Mar 27, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=* <=4.3
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- eswifi socket send buffer overflow ASAN proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo