CVE-2026-12630
Received Received - Intake

Out-of-Bounds Read in Zephyr RTOS 6LoWPAN IPHC

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: Zephyr Project

Description
Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC dispatch word (iphc & NET_6LO_IPHC_DA_MASK, a 4-bit value of 0-15). The reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table. The iphc word is taken directly from the received frame, and get_ihpc_inlined_size() is reached on every inbound 6LoWPAN frame via net_6lo_uncompress() from the 802.15.4 receive path (subsys/net/l2/ieee802154/ieee802154_6lo.c and ieee802154_6lo_fragment.c). An unauthenticated attacker on the radio/adjacent link can therefore craft a frame whose destination addressing-mode nibble selects an out-of-range index, with no privileges or user interaction. The out-of-bounds value becomes the computed inline_size, which then drives header reconstruction before the buffer-length check: it is used to dereference *(pkt->buffer->data + sizeof(iphc) + inline_size) and to compute a size_t diff that can underflow, leading to a further out-of-bounds read of the packet buffer and malformed uncompression. The practical impact is a radio-triggerable out-of-bounds read / denial-of-service on the receiver; the leaked byte is not returned to the attacker. The fix rejects any destination index beyond the table, aborting processing of the malformed frame.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-12630
EUVD
EUVD-2026-60267

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zephyr_project zephyr *
zephyrproject zephyr From 2.0.0 (inc) to 4.4.0 (inc)
zephyrproject zephyr to 4.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in Zephyr RTOS's 6LoWPAN IP Header Compression (IPHC) uncompression code. The issue occurs in the get_ihpc_inlined_size() function where a 4-bit index (0-15) is used to access a table with only 13 valid entries. Reserved index values (13-15) are not checked, causing reads past the table's end. An attacker on the radio link can exploit this by sending a malformed frame to trigger an out-of-bounds read during packet processing.

Detection Guidance

Detecting this vulnerability requires checking Zephyr RTOS versions and monitoring for malformed 6LoWPAN frames. Use 'git log' to verify if the fix is applied in your Zephyr source. Monitor radio traffic for malformed 6LoWPAN frames with tools like Wireshark filtering for 6LoWPAN traffic. Check system logs for crashes or memory corruption during 6LoWPAN frame processing.

Impact Analysis

The vulnerability allows an unauthenticated attacker on the same radio network to cause a denial-of-service on affected devices by sending specially crafted 6LoWPAN frames. This triggers an out-of-bounds read during packet processing, potentially leading to system instability or crashes. The impact is limited to the receiving device and does not expose data to the attacker.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.4.2 or later to apply the bounds check fix. If upgrading is not possible, apply the patch from the Zephyr GitHub commit 1bbb7aefa69eaedc22281ce33aa7a2d5089d5a0e. Disable 6LoWPAN if not required to reduce attack surface. Monitor network traffic for suspicious frames and update intrusion detection systems to flag malformed 6LoWPAN packets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart