CVE-2026-18747: MCUmgr SMP Console Transport DOS Vulnerability

CVE-2026-18747 Overview

CVE-2026-18747 is an integer underflow in the Zephyr Project's MCUmgr Simple Management Protocol (SMP) transport over serial console. The flaw resides in mcumgr_serial_process_frag() within subsys/mgmt/mcumgr/transport/src/serial_util.c. A single unauthenticated 7-byte frame delivered to the management console triggers an underflow of the net_buf::len field. The resulting inflated length exposes an out-of-bounds read [CWE-125] in the SMP request parser, enabling denial of service against the MCUmgr thread and potential memory disclosure via the default-enabled OS echo handler.

Critical Impact
An unauthenticated local attacker with write access to the management console can crash the MCUmgr thread and disclose adjacent memory contents from the reused network buffer pool.

Affected Products

Zephyr RTOS builds enabling CONFIG_MCUMGR_TRANSPORT_UART (smp_uart.c)
Zephyr RTOS builds enabling CONFIG_MCUMGR_TRANSPORT_SHELL (smp_shell.c)
Any transport selecting MCUMGR_TRANSPORT_SERIAL_HAS_SMP_OVER_CONSOLE, including USB CDC-ACM consoles

Discovery Timeline

2026-09-29 - CVE-2026-18747 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-18747

Vulnerability Analysis

The MCUmgr SMP-over-console transport decodes each incoming frame from base64, reads a 16-bit packet length, verifies a CRC, then strips the trailing CRC with rx_ctxt->nb->len -= 2U;. The helper mcumgr_serial_extract_len() accepts any declared length, including 0 and 1. A packet declaring length 0 passes the checksum test trivially because crc16_itu_t() over zero bytes returns the zero seed.

Because net_buf::len is a uint16_t, the subtraction underflows to roughly 65 KB. The buffer is then handed to SMP claiming that payload size while its backing store is only CONFIG_MCUMGR_TRANSPORT_NETBUF_SIZE bytes (default 384). In smp_process_request_packet() the CBOR decoder receives a ~65 KB window into a 384-byte buffer, and each request header's nh_len is bounded only against the inflated length.

Root Cause

The missing minimum-length check in mcumgr_serial_extract_len() permits a declared packet length less than or equal to the CRC size. The unchecked subtraction wraps the uint16_t length field. net_buf_pull(), guarded only by __ASSERT_NO_MSG, then moves the parse cursor out of bounds, and subsequent loop iterations read further headers and CBOR data from adjacent memory.

Attack Vector

The trigger is a single unauthenticated 7-byte line: the 0x06 0x09 packet marker, the base64 group AAA=, and a newline. No prior session state, fragmentation, or credentials are required. Because the transport is unauthenticated, the attacker also controls frames sent before the trigger and can stage buffer contents so a request succeeds with an nh_len larger than the physical buffer. On many boards the console is exposed via USB CDC-ACM rather than a bare UART header, widening reachability.

// Patch: subsys/mgmt/mcumgr/transport/src/serial_util.c
 	}
 
 	rx_ctxt->pkt_len = net_buf_pull_be16(rx_ctxt->nb);
+
+	if (rx_ctxt->pkt_len <= sizeof(uint16_t)) {
+		return -EINVAL;
+	}
+
 	return 0;
 }
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/f7fc3e779a59c68c96eaf63a6b03ac7489f5e4a5

The fix rejects any declared packet length of two bytes or fewer, so the CRC-strip subtraction can no longer underflow.

Detection Methods for CVE-2026-18747

Indicators of Compromise

Inbound console frames beginning with the SMP start marker 0x06 0x09 followed by the base64 sequence AAA= and a newline.
Unexpected faults or resets of the MCUmgr worker thread following console traffic.
Anomalous OS echo responses containing bytes not originating from the current request payload.

Detection Strategies

Instrument the serial console path to log frames whose decoded pkt_len is less than or equal to 2 and treat them as attack attempts.
Correlate MCUmgr thread crashes with prior 7-byte console writes to identify probing activity.
Where the console rides on USB CDC-ACM, monitor host-side USB enumeration and endpoint writes from unauthorized processes.

Monitoring Recommendations

Enable Zephyr fault logging and forward crash traces to a centralized collector for review.
Audit which host processes have write access to /dev/ttyACM* or equivalent virtual COM ports exposed by embedded devices.
Track firmware inventory and Zephyr commit revisions to confirm which fleet members remain unpatched.

How to Mitigate CVE-2026-18747

Immediate Actions Required

Apply the upstream Zephyr commit f7fc3e779a59c68c96eaf63a6b03ac7489f5e4a5 and rebuild firmware for all affected devices.
Restrict physical and USB access to management consoles on production hardware.
Disable CONFIG_MCUMGR_TRANSPORT_UART and CONFIG_MCUMGR_TRANSPORT_SHELL on devices that do not require field management.

Patch Information

The fix is committed to the Zephyr Project mainline in commit f7fc3e779a59c68c96eaf63a6b03ac7489f5e4a5. It adds a minimum receive-size check in mcumgr_serial_extract_len() that returns -EINVAL when the declared pkt_len is less than or equal to sizeof(uint16_t). Details are published in GitHub Security Advisory GHSA-g6cx-xj75-hvfw.

Workarounds

Disable the OS echo handler by clearing CONFIG_MCUMGR_GRP_OS_ECHO to reduce memory-disclosure exposure until firmware can be updated.
Gate console availability behind a physical jumper, boot-time authentication, or production fuse where the hardware design permits.
Remove USB CDC-ACM console exposure from production images and reserve it for engineering builds only.

bash

# Kconfig fragment to disable serial SMP transports on production builds
CONFIG_MCUMGR_TRANSPORT_UART=n
CONFIG_MCUMGR_TRANSPORT_SHELL=n
CONFIG_MCUMGR_GRP_OS_ECHO=n