CVE-2026-14368: LwM2M JSON Buffer Overflow Vulnerability

CVE-2026-14368 Overview

CVE-2026-14368 is an off-by-one out-of-bounds write [CWE-193, CWE-787] in the Zephyr real-time operating system's Lightweight Machine-to-Machine (LwM2M) JSON content formatter. The get_string() function in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied buffer and appends a NUL terminator. A faulty length guard accepts a string whose length equals buflen, causing buf[string_length] = '\0' to write one byte past the end of the buffer. A LwM2M server acting as the client's DTLS peer can trigger this deterministic single-byte overflow through a LwM2M WRITE operation.

Critical Impact
An authenticated LwM2M server can corrupt adjacent memory in a Zephyr client through a crafted CoAP WRITE payload, causing data corruption or a device crash.

Affected Products

Zephyr Project RTOS — subsys/net/lib/lwm2m/lwm2m_rw_json.c
Zephyr LwM2M subsystem builds prior to commit ba38f4b94337cc2c2446277ac181bdb5fec8f2b2
Embedded devices using Zephyr LwM2M client with JSON content format enabled

Discovery Timeline

2026-08-31 - CVE-2026-14368 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-14368

Vulnerability Analysis

The vulnerability resides in the JSON content formatter's string handler for LwM2M resources. do_write_op_json() parses the payload obtained from coap_packet_get_payload(), and get_string() is invoked from lwm2m_write_handler() via engine_get_string() in subsys/net/lib/lwm2m/lwm2m_message_handling.c for a LWM2M_RES_TYPE_STRING resource. The destination is either the resource instance's fixed data buffer (res_inst->data_ptr/max_data_len) or the engine validation buffer (msg->ctx->validate_buf).

The overflow writes a single fixed byte (0x00) immediately past the target buffer. It is not an information disclosure and the written value is constant, so it is not a direct code-execution primitive. However, corrupting an adjacent resource value, length or flag field, or struct member can produce data corruption or a crash. Impact depends on memory layout.

Root Cause

The length guard uses strict inequality: if (string_length > buflen) rejects only strings longer than the buffer. A string whose length exactly equals buflen passes the check. memcpy() then fills the entire buffer, and the subsequent NUL termination writes one byte beyond the allocated region. The other Zephyr content formatters (lwm2m_rw_plain_text.c, lwm2m_rw_oma_tlv.c, lwm2m_rw_senml_json.c, lwm2m_rw_cbor.c, lwm2m_rw_senml_cbor.c) already used the correct >= boundary check.

Attack Vector

A LwM2M server that has completed the DTLS handshake with the client can issue a WRITE operation targeting a string resource. By setting the JSON string value's length equal to the target buffer size, the server deterministically triggers the one-byte overflow on the client. This requires an authenticated peer relationship with the client, limiting exploitation to malicious or compromised LwM2M servers.

 	string_length = strlen(fd->array_object.val_string);
 
-	if (string_length > buflen) {
+	if (string_length >= buflen) {
 		LOG_WRN("Buffer too small to accommodate string");
 		return -ENOMEM;
 	}
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/ba38f4b94337cc2c2446277ac181bdb5fec8f2b2

The patch changes the comparison operator from > to >=, rejecting the exact-length case and aligning the JSON formatter with the other content formatters.

Detection Methods for CVE-2026-14368

Indicators of Compromise

Unexpected Zephyr device reboots or hard faults following LwM2M WRITE operations from a management server.
Log entries indicating memory corruption, stack canary failures, or MPU faults on LwM2M-enabled devices.
Anomalous LwM2M string resource values that appear truncated or corrupt after server-initiated WRITE operations.

Detection Strategies

Inspect CoAP payloads to LwM2M clients for JSON string values whose length exactly matches known resource buffer sizes.
Monitor LwM2M server-to-client WRITE traffic for repeated boundary-length strings that could indicate probing.
Audit Zephyr build manifests to identify firmware images built from revisions prior to commit ba38f4b9.

Monitoring Recommendations

Enable Zephyr fault handlers and telemetry export to a central log store for post-mortem analysis of embedded device crashes.
Correlate LwM2M server session metadata with client crash events across your device fleet.
Alert on unexpected changes to LwM2M string resource values that deviate from provisioned configuration.

How to Mitigate CVE-2026-14368

Immediate Actions Required

Rebuild affected Zephyr firmware against a tree containing commit ba38f4b94337cc2c2446277ac181bdb5fec8f2b2 and deploy through your OTA update channel.
Restrict LwM2M client bootstrap and registration to trusted server URIs and enforce DTLS with certificate or PSK authentication.
If JSON content format is not required, disable it in the LwM2M client configuration to remove the vulnerable code path.

Patch Information

The fix is available in the Zephyr Project upstream tree. Refer to the GitHub commit and the GHSA-vg53-h6qq-xx7h security advisory for backporting guidance. The patch modifies the boundary check in get_string() within subsys/net/lib/lwm2m/lwm2m_rw_json.c.

Workarounds

Configure the LwM2M client to prefer alternative content formats (CBOR, SenML-JSON, SenML-CBOR, OMA-TLV, or plain text), whose parsers already implement the correct boundary check.
Enforce strict allowlisting of LwM2M server endpoints at the network layer to reduce exposure to rogue servers.
Enable Zephyr memory protection features such as MPU-backed stack guards and userspace isolation to contain corruption impact.

bash

# Disable JSON content format in Zephyr LwM2M client (prj.conf)
CONFIG_LWM2M_RW_JSON_SUPPORT=n
CONFIG_LWM2M_RW_SENML_CBOR_SUPPORT=y
CONFIG_LWM2M_DTLS_SUPPORT=y