CVE-2026-11810

Received Received - Intake

NULL Pointer Dereference in Zephyr UpdateHub Firmware Update Agent

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Zephyr Project

Description

The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length (objects_len != 2) and then dereferences objects[1].objects[0].objects.sha256sum via strlen() without checking that the inner object array of element [1] is non-empty. The metadata is attacker-influenceable network input: the agent fetches it over CoAP from the configured UpdateHub server during its routine OTA probe. A malicious or compromised update server (or, when DTLS is disabled, a network man-in-the-middle) can return a response whose second outer object array is empty. Because the parse target is zero-initialised, the corresponding objects[1].objects[0].objects.sha256sum pointer is NULL, and the subsequent strlen() dereferences address zero. The same defect exists in both the 'any boards' and 'some boards' metadata layouts. The resulting CPU fault is fatal under Zephyr's default error handling, halting or resetting the device, so the flaw is a remotely triggerable denial of service. Impact is limited to availability; it is a read from NULL with no out-of-bounds write, memory corruption, or information disclosure. The fix rejects metadata whose inner object array is empty before any dereference, on both layouts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-11810

EUVD

EUVD-2026-55805

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is in the UpdateHub firmware-update agent used in Zephyr OS. It involves improper parsing of JSON metadata from an update server. The agent fails to validate the inner array structure before accessing it, leading to a NULL pointer dereference when calling strlen() on a NULL pointer. This causes a fatal CPU fault, halting or resetting the device.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the UpdateHub firmware-update agent when processing malformed JSON metadata. Detection requires inspecting network traffic for CoAP requests to UpdateHub servers and analyzing the JSON response structure. Check if the server returns a second outer array element with an empty inner object array. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows a remote attacker to trigger a denial of service by sending maliciously crafted metadata. The device will crash or reset, disrupting normal operation. The impact is limited to availability; no data is leaked or corrupted.

Mitigation Strategies

Apply the vendor fix that rejects metadata with empty inner object arrays before dereferencing. Disable CoAP-based OTA updates if not required or ensure DTLS is enabled to prevent network interception. Monitor devices for unexpected resets or halts during OTA probe operations.

Hi! I’m here to help you understand CVE-2026-11810. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70