CVE-2026-126957

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.

• CWE-125
• CWE-191
• CWE-200

• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cvv6-5f6x-87qf

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126932Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerab…4.3
• CVE-2026-126933Zipline 4.0.0 before 4.8.0 contains an upload filter bypass …4.3
• CVE-2026-126934Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vuln…6.5
• CVE-2026-126935Zipline before 4.8.0 contains a race condition vulnerability…3.7
• CVE-2026-12694Missing Authorization vulnerability in Vimesoft Inc. Enterpr…9.1
• CVE-2026-12695The miniOrange 2FA WordPress plugin before 6.2.6 does not v…8.1
• CVE-2026-12696The wpForo Forum WordPress plugin before 3.1.2 does not sani…5.4
• CVE-2026-12697The wpForo Forum WordPress plugin before 3.1.2 does not veri…5.4
• CVE-2026-12698The wpForo Forum WordPress plugin before 3.1.3 does not rest…4.3
• CVE-2026-126982A type allow-list bypass in the BSON serialization library o…7.5
• CVE-2026-126991The Wikidata Lookup expansion module (wiki.py) in MISP misp-…5.3
• CVE-2026-126993A security flaw has been discovered in SiteServer SSCMS up t…5.3