CVE-2026-5072

A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes. An attacker sends a crafted PTP_MSG_MANAGEMENT message to set an unvalidated negative log_announce_interval value in the port's data set. When a subsequent PTP_MSG_ANNOUNCE message is processed, port_timer_set_timeout_random computes a timeout as NSEC_PER_SEC >> -log_seconds; if the attacker-supplied value is sufficiently negative (e.g., -127), the shift amount exceeds the 64-bit integer width, triggering undefined behavior in C. This can cause a system crash via a compiler-generated illegal instruction trap on some architectures, or produce an erroneous zero timeout leading to resource starvation loops or other logical errors.

• CWE-1335

• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3v98-458v-388rExploit, Patch, Vendor Advisory

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50708A Stored Cross-Site Scripting (XSS) vulnerability exists in …4.8
• CVE-2026-50709A Stored Cross-Site Scripting (XSS) vulnerability exists in …4.8
• CVE-2026-5071The SocketCAN implementation validates the length of a user-…7.8
• CVE-2026-50710A Stored Cross-Site Scripting (XSS) vulnerability exists in …4.6
• CVE-2026-50711A Stored Cross-Site Scripting (XSS) vulnerability exists in …4.6
• CVE-2026-50712A Stored Cross-Site Scripting (XSS) vulnerability exists in …4.8
• CVE-2026-50721Libreswan, via the function RSA_authenticate_hash_signature_…5.9
• CVE-2026-50722Libreswan, via the function RSA_authenticate_hash_signature_…5.9
• CVE-2026-5073The ARMember Premium plugin for WordPress is vulnerable to S…7.5
• CVE-2026-50733Markdown Preview Enhanced before 0.8.28 parses WaveDrom diag…8.8
• CVE-2026-50734Memory Allocation with Excessive Size Value vulnerability in…7.5
• CVE-2026-50735pglogical's apply worker does not sufficiently validate the …6.1