CVE-2026-0849CWE-120

CVE-2026-0849

Low · published March 16, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
14.8
In the wild
Unconfirmed
What it is

Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00244 · 14.8th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-03-16T18:18Z
Affected products (4)
ProductVersionsFixed in
zephyrproject/zephyrall versions—
zephyrproject/zephyrall versions—
zephyrproject/zephyrall versions—
zephyrproject/zephyrall versions—
References (2)
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-ff4p-3ggg-prp6 · [email protected]https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-ff4p-3ggg-prp6 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 MAR 21:05Z
    crypto: ATAES132A response length allows stack buffer overflow
    cvelistv5