CVE-2026-76788

Received Received - Intake

Buffer Overflow in OSDP Control Panel

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Zephyr Project

Description

The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation performed is that the declared length is self-consistent with the number of payload bytes present in the frame. Because the attacker controls both the length field and the frame length, that check imposes no bound, and the subsequent memcpy() writes into the fixed 64-byte data arrays of struct osdp_event_keypress / struct osdp_event_cardread (OSDP_EVENT_MAX_DATALEN). The sibling REPLY_FMT handler in the same switch already carried the missing > OSDP_EVENT_MAX_DATALEN bound. The defect is reached from cp_process_reply(), which reads bytes from the OSDP RS-485 channel and passes them through osdp_phy_check_packet() and osdp_phy_decode_packet() before dispatching on the reply ID. Triggering it requires CONFIG_OSDP with CONFIG_OSDP_MODE_CP and an application event callback registered (the normal Control Panel integration), plus a frame carrying a correct SOM, a valid CRC-16, and a matching 2-bit sequence number — all of which are computable or observable by anyone on the bus. No check ties the reply ID to the outstanding command, so an oversized REPLY_KEYPPAD or REPLY_RAW is accepted as the answer to a routine CMD_POLL. A malicious or compromised card reader, or anyone with access to the RS-485 wiring, can supply such a frame; CONFIG_OSDP_SC_ENABLED only helps while a secure channel is active, and a single unauthenticated frame carrying a bad MAC causes sc_deactivate(), after which plaintext replies are again accepted. With the default CONFIG_OSDP_UART_BUFFER_LENGTH of 256, roughly 180 bytes of fully attacker-chosen data can be written past the end of the stack-allocated event object, over saved registers and the return address on typical Cortex-M and RISC-V frame layouts (Zephyr does not enable stack canaries by default). The impact ranges from a hard crash of the access-control panel to potential control-flow hijack in the context of the OSDP receive thread. The fix adds an OSDP_EVENT_MAX_DATALEN bound to both handlers, capping each memcpy() at the size of its destination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-76788

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	3.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a buffer overflow in the OSDP Control Panel reply parser. It occurs when processing REPLY_KEYPPAD or REPLY_RAW messages. The attacker controls the payload length and frame, bypassing validation checks. This leads to a memcpy() writing beyond the fixed-size data arrays into adjacent stack memory, potentially overwriting saved registers or return addresses.

Detection Guidance

This vulnerability involves a buffer overflow in the OSDP Control Panel reply parser. Detection requires monitoring for malformed REPLY_KEYPPAD or REPLY_RAW frames with payload lengths exceeding 64 bytes. Inspect OSDP traffic on the RS-485 bus for frames with incorrect payload lengths or unexpected reply IDs. Use protocol analyzers like Wireshark with OSDP dissectors to capture and validate frame structures.

Impact Analysis

The impact ranges from system crashes to potential control-flow hijacking in the OSDP receive thread. An attacker with access to the RS-485 bus can exploit this to execute arbitrary code or cause denial of service. The default buffer size allows roughly 180 bytes of attacker-chosen data to be written past the stack-allocated event object.

Mitigation Strategies

Apply the vendor patch that adds OSDP_EVENT_MAX_DATALEN bounds to REPLY_KEYPPAD and REPLY_RAW handlers. Disable CONFIG_OSDP_MODE_CP if not required. Ensure secure channels are enforced by enabling CONFIG_OSDP_SC_ENABLED. Restrict physical and network access to the RS-485 bus to prevent unauthorized frame injection.

Hi! I’m here to help you understand CVE-2026-76788. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70