# CVE-2026-10849: Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body > A heap out-of-bounds write in the Zephyr hawkBit client allows remote attackers to corrupt memory via crafted HTTP responses, potentially leading to code execution or crashes. - **Severity:** High 8.2 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** No - **Published:** 3 Aug 2026 - **Updated:** 31 Aug 2026 - **Also known as:** GHSA-39h3-7phx-pwhv ## What is CVE-2026-10849? CVE-2026-10849 is a high-severity memory corruption vulnerability in Zephyrproject Zephyr, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the full response has arrived, the code writes response_data[downloaded_size] = '\0' — and whenever the accumulated body length equals the allocation, that terminator lands one byte past the end of the heap object (a heap-based out-of-bounds write, CWE-122 / CWE-787). The body length and fragmentation are taken directly from the parsed HTTP response (rsp->body_frag_start / rsp->body_frag_len) and are fully controlled by the remote hawkBit server, which chooses its own response length. The precise trigger depends on how the buffer grows, and both forms are remotely reachable. Since v4.0.0 the reallocation is sized to exactly downloaded_size + body_len, so any response body larger than the 1100-byte initial buffer makes the out-of-bounds write deterministic; such response sizes are normal for hawkBit deployment metadata. Before v4.0.0 the buffer grew by doubling and the growth check ((downloaded_size + body_len) > response_buffer_size) is false at equality, so a response body whose length is exactly the current allocation — 1100 bytes with the default initial buffer — skips the reallocation entirely and writes the terminator at response_data[1100] of an 1100-byte object. The HTTP length-mismatch check does not catch this, because the declared and received lengths genuinely agree. Either form is reachable by a malicious, compromised, or man-in-the-middle update server (TLS is optional and, when enabled, does not protect against a hostile server), with no authentication of response content and no client-side length cap protecting the write. The out-of-bounds write is a fixed single NUL byte immediately following the allocation, corrupting adjacent allocator metadata or the next allocation. The practical impact is heap corruption leading to denial of service (fault on a subsequent allocation or free), with the bounded, allocator-dependent possibility of further corruption. The fix sizes the buffer to the body length plus one and copies with memcpy, ensuring the terminator always lands within the allocation. Weakness: CWE-787 (Out-of-bounds Write), CWE-122 (Heap-based Buffer Overflow) ## Which versions are affected by CVE-2026-10849? It affects 1 product. Products: Zephyrproject Zephyr. ## How do I fix CVE-2026-10849? No fix has been published for CVE-2026-10849 yet. Limit exposure of the affected software until one is available. ## Is CVE-2026-10849 being exploited? There is no known exploitation of CVE-2026-10849 in the wild and no public exploit code. ## Other vulnerabilities in Zephyrproject Zephyr - [CVE-2026-5067](https://insights.sbomify.com/CVE-2026-5067/): Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key (critical 9.8) - [CVE-2022-3806](https://insights.sbomify.com/CVE-2022-3806/): Bluetooth HCI Error Handling Double Free (critical 9.8) - [CVE-2017-14199](https://insights.sbomify.com/CVE-2017-14199/): Memory corruption in getaddrinfo (critical 9.8) - [CVE-2018-1000800](https://insights.sbomify.com/CVE-2018-1000800/): Null dereference in n/a (critical 9.8) - [CVE-2021-3329](https://insights.sbomify.com/CVE-2021-3329/): DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer (critical 9.6) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-10849 and fix it if it is affected. What it is: CVE-2026-10849 is a high-severity memory corruption vulnerability in Zephyrproject Zephyr, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-10849 in the wild and no public exploit code. Affected product: Zephyrproject Zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-10849/ (Markdown: https://insights.sbomify.com/CVE-2026-10849/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-10849 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-10849 - OSV: https://osv.dev/vulnerability/CVE-2026-10849 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-10849/ Summaries are generated and may contain mistakes; the official description above is the record.