CVE-2026-10672: LwM2M Firmware Update DoS Vulnerability

CVE-2026-10672 Overview

CVE-2026-10672 is an out-of-bounds read vulnerability [CWE-125] in the Zephyr RTOS LwM2M (Lightweight Machine-to-Machine) firmware update pull client. The flaw resides in subsys/net/lib/lwm2m/lwm2m_pull_context.c, where the firmware Package URI is copied into a fixed 128-byte static buffer without length validation. A LwM2M management server, or an on-path attacker on a session lacking strong DTLS, can supply a URI between 128 and 254 characters. The resulting unterminated buffer is later processed as a C string, leaking adjacent static memory to the server or proxy and potentially crashing the device.

Critical Impact
Attackers can trigger information disclosure of adjacent device memory and denial of service on affected Zephyr-based IoT devices via a crafted Package URI Write.

Affected Products

Zephyr RTOS versions 3.0.0 through 4.4.0
Devices with CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT enabled (default-on)
LwM2M clients using subsys/net/lib/lwm2m/lwm2m_pull_context.c

Discovery Timeline

2026-07-14 - CVE-2026-10672 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10672

Vulnerability Analysis

The vulnerability originates in the pull-context refactor of the Zephyr LwM2M subsystem, first released in v3.0.0. The function copies the server-supplied Package URI into context.uri, a static buffer sized by CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN (default 128 bytes). The copy uses memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), transferring exactly the destination size regardless of the source length. No NUL terminator is appended when the source URI is longer than the destination.

The LwM2M Firmware-Update object resource /5/0/1 stores the Package URI in a 255-byte buffer. A management server can write a URI of 128 to 254 characters, all of which pass validation at the object layer. Downstream code then treats context.uri as a NUL-terminated C string, calling strlen(context.uri) and http_parser_parse_url() on it. The read walks past the buffer into adjacent static memory until an incidental NUL byte is encountered.

Root Cause

The root cause is missing input validation between the LwM2M object storage layer (255 bytes) and the pull-context buffer (128 bytes). The memcpy uses the destination size as the length argument rather than validating the actual source string length, and no NUL guarantee is enforced after the copy.

Attack Vector

Exploitation requires an attacker positioned as a LwM2M management server, or an on-path attacker against a session without strong DTLS protection. The attacker issues a Write to resource /5/0/1 with a URI of 128-254 characters. The over-read bytes are appended to outbound CoAP requests as URI-path or PROXY-URI options, delivering adjacent device memory back to the attacker. The malformed string can also trigger a crash, resulting in denial of service.

 		return -EINVAL;
 	}
 
+	if (strlen(uri) >= sizeof(context.uri)) {
+		LOG_ERR("URI too long, maximum supported length is %zu characters",
+			sizeof(context.uri) - 1U);
+		return -ENOMEM;
+	}
+
 	ret = start_service();
 	if (ret) {
 		LOG_ERR("Failed to start the pull-service");
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/99a164df5cea5af76e32b57c6d51854f018969a2

The patch adds a strlen(uri) >= sizeof(context.uri) check that returns -ENOMEM for oversized URIs before the copy occurs.

Detection Methods for CVE-2026-10672

Indicators of Compromise

LwM2M Write operations to resource /5/0/1 containing URI values longer than 127 characters.
Outbound CoAP firmware pull requests with abnormally long or malformed URI-path or PROXY-URI options.
Unexpected Zephyr device reboots or crash logs referencing lwm2m_pull_context or http_parser_parse_url.

Detection Strategies

Inspect LwM2M server logs for clients receiving Package URI Writes with lengths at or beyond 128 bytes.
Deploy CoAP-aware network monitoring to flag firmware-update requests carrying URIs above the expected size envelope.
Correlate device availability telemetry with LwM2M management operations to identify DoS patterns following URI writes.

Monitoring Recommendations

Enforce DTLS with mutual authentication on all LwM2M sessions and alert on unauthenticated Package URI writes.
Log and retain Firmware-Update object interactions for review, including source server identity and URI length.
Baseline expected firmware update URIs per fleet and alert on deviations in structure or length.

How to Mitigate CVE-2026-10672

Immediate Actions Required

Upgrade Zephyr-based firmware to a release incorporating the fix from commit 99a164df5cea5af76e32b57c6d51854f018969a2.
Audit LwM2M management server access controls and rotate any credentials shared with untrusted operators.
Enforce DTLS with strong cipher suites on every LwM2M session to remove the on-path attacker scenario.

Patch Information

The upstream fix is available in the Zephyr project. See the GitHub Commit Details and the GitHub Security Advisory GHSA-rf6j-4mpp-j9mf. The patch rejects oversized URIs with -ENOMEM and switches the copy operation to strcpy(), guaranteeing a NUL-terminated buffer.

Workarounds

Disable CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT where firmware pull is not required.
Increase CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN to 255 to match the object buffer, eliminating the truncation window until patching is possible.
Restrict Package URI writes at the LwM2M server to trusted, length-validated values.

bash

# Kconfig hardening for affected devices
CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT=n
# Or, if pull mode is required:
CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN=255
CONFIG_LWM2M_DTLS_SUPPORT=y