CVE-2026-12634

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Zephyr RTOS NVS Settings Subsystem

Publication date: 2026-08-19

Last updated on: 2026-08-26

Assigner: Zephyr Project

Description

The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with buf[rc] = '\0', where rc is the return value of nvs_read(). Per its contract, nvs_read() returns the full stored entry length (wlk_ate.len), which can exceed the supplied buffer length — only MIN(len, stored_len) bytes are actually copied, but the return value may be much larger, bounded only by the NVS sector size. Three sites (settings_nvs_cache_match(), settings_nvs_load(), and settings_nvs_save()) used this value directly as the NUL index without clamping, so an oversized stored name entry causes a single \0 byte to be written past the end of the stack buffer at an attacker-influenced offset (CWE-787). The oversized entry cannot arise through the normal settings API, where names are bounded by SETTINGS_MAX_NAME_LEN. It requires an actor able to write the flash that backs the settings partition — a co-resident or untrusted component sharing the flash device, a malicious settings image/restore, or offline/physical flash access (a shared-flash threat model). The malformed entry is parsed when settings_load() runs at boot or subsystem init, or during settings_save(). The out-of-bounds write is a single NUL byte at an offset equal to the crafted entry length (up to the NVS sector size), so the practical impact is a crash or denial of service and limited stack corruption rather than reliable code execution. There is no confidentiality impact, and the path is not reachable from the network through the ordinary settings interface. The fix skips any entry whose nvs_read() length is greater than or equal to the buffer size before performing the NUL store.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-26

Generated

2026-09-10

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-12634

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	to 3.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a stack-based buffer overflow in the Zephyr RTOS settings subsystem. When reading stored setting names, the code uses a fixed 74-byte stack buffer but trusts the length returned by nvs_read(), which may exceed the buffer size. The code then writes a null terminator at an attacker-controlled offset beyond the buffer, causing a single-byte overflow. This can lead to crashes or denial of service but is not easily exploitable for code execution.

Detection Guidance

This vulnerability requires access to the flash storage backing the Zephyr settings subsystem. Detection involves inspecting the NVS partition for oversized setting-name entries. Check Zephyr logs during boot or settings operations for crashes or stack corruption. Review flash dumps for entries exceeding SETTINGS_MAX_NAME_LEN (typically 74 bytes).

Commands: Use nvs_tool or similar to dump NVS partition contents. Compare entry lengths against buffer size. Monitor system logs for crashes during settings_load() or settings_save().

Impact Analysis

The impact is limited to system crashes or denial of service due to stack corruption. It does not allow data theft or remote exploitation. The attack requires physical access, malicious firmware, or a co-resident component with flash write access. Normal application code cannot trigger this issue.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it does not involve data breaches or confidentiality loss. However, repeated crashes or denial of service could indirectly affect system availability, which may be relevant for compliance in some contexts. The risk is low due to the limited exploitability.

Mitigation Strategies

Apply the official patch from Zephyr that clamps the nvs_read() length before NUL termination. Restrict physical and logical access to the flash device to prevent malicious writes. Validate any settings images or restores before loading.

If patching is not immediately possible, disable the settings subsystem if unused or implement runtime checks to reject oversized entries during nvs_read().

Hi! I’m here to help you understand CVE-2026-12634. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70