CVE-2026-8718

Received Received - Intake

Heap Buffer Overflow in Zephyr RTOS TLS Socket Option Handling

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Zephyr Project

Description

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_SSL_CID_OUT_LEN_MAX) into that buffer without a destination-size parameter, so a caller-supplied optlen smaller than the CID causes a write of up to 31 bytes past the buffer end. In CONFIG_USERSPACE builds the getsockopt syscall verifier (z_vrfy_zsock_getsockopt) bounce-buffers the user's optval into a kernel allocation of exactly optlen bytes (k_usermode_alloc_from_copy -> z_thread_malloc), so an unprivileged user thread that passes a small optlen on a connected DTLS socket with Connection ID enabled induces a kernel-heap buffer overflow, with the overflowing content being the remote peer's CID. The defect requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, an established DTLS session with a negotiated peer CID, and (for the kernel-crossing case) CONFIG_USERSPACE. Introduced when the TLS_DTLS_CID option was added (v3.5.0). The fix rejects callers whose optlen is below MBEDTLS_SSL_CID_OUT_LEN_MAX with -EINVAL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-8718

Affected Vendors & Products

Vendor	Product	Version / Range
mbed_tls	mbed_tls	3.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a buffer overflow in the Zephyr RTOS TLS implementation. When handling a getsockopt call for DTLS peer connection ID, the function tls_opt_dtls_peer_connection_id_value_get() copies the peer's negotiated DTLS Connection ID into a caller-supplied buffer without checking if the buffer is large enough. This can lead to a write past the buffer's end, potentially corrupting kernel memory.

Detection Guidance

This vulnerability requires specific conditions to be present: CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID enabled, an established DTLS session with a negotiated peer CID, and for kernel-crossing cases, CONFIG_USERSPACE. Detection would involve checking kernel and TLS library configurations for these settings.

Impact Analysis

An attacker could exploit this to cause a kernel heap buffer overflow by sending a small optlen value on a connected DTLS socket with Connection ID enabled. This could lead to system crashes, privilege escalation, or arbitrary code execution in the kernel, depending on the system configuration and attacker capabilities.

Mitigation Strategies

Apply the fix that rejects callers with optlen below MBEDTLS_SSL_CID_OUT_LEN_MAX with -EINVAL. Disable CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID if not required. Ensure kernel and TLS library are updated to versions containing the patch.

Hi! I’m here to help you understand CVE-2026-8718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70