# CVE-2026-76788: Stack out-of-bounds write in the OSDP Control Panel reply parser

> Attacker on RS-485 bus can trigger stack overflow in OSDP parser, potentially executing arbitrary code or escalating privileges.

- **Severity:** High 8.8 (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 19 Oct 2026
- **Updated:** 20 Oct 2026
- **Also known as:** GHSA-fgg7-h8p9-9q3w

## What is CVE-2026-76788?

CVE-2026-76788 is a high-severity memory corruption vulnerability in zephyrproject zephyr, published on 19 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the received frame and the only validation performed is that the declared length is self-consistent with the number of payload bytes present in the frame. Because the attacker controls both the length field and the frame length, that check imposes no bound, and the subsequent memcpy() writes into the fixed 64-byte data arrays of struct osdp_event_keypress / struct osdp_event_cardread (OSDP_EVENT_MAX_DATALEN). The sibling REPLY_FMT handler in the same switch already carried the missing > OSDP_EVENT_MAX_DATALEN bound.

The defect is reached from cp_process_reply(), which reads bytes from the OSDP RS-485 channel and passes them through osdp_phy_check_packet() and osdp_phy_decode_packet() before dispatching on the reply ID. Triggering it requires CONFIG_OSDP with CONFIG_OSDP_MODE_CP and an application event callback registered (the normal Control Panel integration), plus a frame carrying a correct SOM, a valid CRC-16, and a matching 2-bit sequence number — all of which are computable or observable by anyone on the bus. No check ties the reply ID to the outstanding command, so an oversized REPLY_KEYPPAD or REPLY_RAW is accepted as the answer to a routine CMD_POLL. A malicious or compromised card reader, or anyone with access to the RS-485 wiring, can supply such a frame; CONFIG_OSDP_SC_ENABLED only helps while a secure channel is active, and a single unauthenticated frame carrying a bad MAC causes sc_deactivate(), after which plaintext replies are again accepted.

With the default CONFIG_OSDP_UART_BUFFER_LENGTH of 256, roughly 180 bytes of fully attacker-chosen data can be written past the end of the stack-allocated event object, over saved registers and the return address on typical Cortex-M and RISC-V frame layouts (Zephyr does not enable stack canaries by default). The impact ranges from a hard crash of the access-control panel to potential control-flow hijack in the context of the OSDP receive thread. The fix adds an OSDP_EVENT_MAX_DATALEN bound to both handlers, capping each memcpy() at the size of its destination.

Weakness: CWE-787 (Out-of-bounds Write)

## Which versions are affected by CVE-2026-76788?


## How do I fix CVE-2026-76788?

No fix has been published for CVE-2026-76788 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-76788 being exploited?

There is no known exploitation of CVE-2026-76788 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-76788 and fix it if it is affected.

What it is: CVE-2026-76788 is a high-severity memory corruption vulnerability in zephyrproject zephyr, published on 19 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-76788 in the wild and no public exploit code.

Affected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-76788/ (Markdown: https://insights.sbomify.com/CVE-2026-76788/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-76788
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76788
- OSV: https://osv.dev/vulnerability/CVE-2026-76788

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-76788/
Summaries are generated and may contain mistakes; the official description above is the record.