ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c

published 2026-11-12 8h ago modified 2026-11-12 7h ago also GHSA-cvv6-5f6x-87qf , EUVD-2026-124154

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository zephyrproject-rtos/zephyr. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.

Is CVE-2026-126957 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

zephyrproject-rtos Zephyr

Classification

Weakness

CWE-125 Out-of-bounds Read
CWE-191 Integer Underflow (Wrap or Wraparound)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

github.com /zephyrproject-rtos/zephyr/security/advisories/GHSA-cvv6-5f6x-87qf
advisory

Sources

CVE List CVE-2026-126957
NVD CVE-2026-126957
Maintainer advisory GHSA-cvv6-5f6x-87qf

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of zephyrproject-rtos/zephyr published their own advisory on GitHub. Reviewed sources take precedence over it.