← Vulnerability feed

Vulnerability record · CVE-2026-5066 · published 4 June 2026

CVE-2026-5066: Zephyrproject zephyr out-of-bounds write vulnerability

Zephyrproject · Zephyr

A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. struct net_sockaddr is an opaque type, so an application can pass an addrlen larger than sizeof(struct net_sockaddr) (for example 128 bytes into a 24-byte stack buffer), causing the memcpy to read and write past the end of the address memory used by the TLS session cache. This out-of-bounds write can lead to a crash and denial of service, and potentially to arbitrary code execution.

8.8 CVSS 3.1 High EPSS 0.47% · top 62.1% CWE-787 · Out-of-bounds write
8.8CVSS 3.1 base score
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
22 Jul 2026Last modified by NVD

Description

A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. struct net_sockaddr is an opaque type, so an application can pass an addrlen larger than sizeof(struct net_sockaddr) (for example 128 bytes into a 24-byte stack buffer), causing the memcpy to read and write past the end of the address memory used by the TLS session cache. This out-of-bounds write can lead to a crash and denial of service, and potentially to arbitrary code execution.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wgrc-jrf6-24f3 ExploitPatchVendor Advisory
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wgrc-jrf6-24f3 ExploitPatchVendor Advisory

Track CVE-2026-5066 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2023-4260Zephyrproject zephyr classic buffer overflow vulnerabilityPotential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.EPSS 0.77%9.8CVE-2026-10666Zephyrproject zephyr stack-based buffer overflow vulnerabilityparse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed …EPSS 0.65%9.8CVE-2026-5067Zephyrproject zephyr out-of-bounds write vulnerabilityA remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Ke…EPSS 0.87%9.8CVE-2026-1678Zephyrproject zephyr out-of-bounds write vulnerabilitydns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, a…EPSS 0.38%9.8CVE-2023-6881Zephyrproject zephyr classic buffer overflow vulnerabilityPossible buffer overflow in is_mount_pointEPSS 0.44%9.8CVE-2023-6249Zephyrproject zephyr vulnerabilitySigned to unsigned conversion esp32_ipm_sendEPSS 0.44%9.8CVE-2023-5779Zephyrproject zephyr out-of-bounds write vulnerabilitycan: out of bounds in remove_rx_filter functionEPSS 0.44%9.8CVE-2023-6749Zephyrproject zephyr stack-based buffer overflow vulnerabilityUnchecked length coming from user input in settings shellEPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2026-5066), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.