{"schema":"threatline.record/2","record":{"id":"CVE-2026-18418","aliases":["GHSA-48w8-fjhj-r9w8"],"summary":"Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name","details":"The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport guarantees the array is NUL-terminated. The only code that verifies termination is zbus_proxy_agent_receive_cb() in subsys/zbus/proxy_agent/zbus_proxy_agent.c, which rejects the frame in precisely those cases — so the warning printed a non-terminated buffer exactly on the error paths where the name had been found invalid (or, for an invalid message_size, had not been inspected at all).\n\nAny peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it, by sending a frame with an out-of-range message_size or with channel_name[] containing no NUL byte. Reaching the code requires CONFIG_ZBUS_PROXY_AGENT_IPC and logging built at warning level or above (the default), and requires control over the firmware of the peer domain — typically a second core on the same SoC.\n\nThe resulting strlen() inside the log packager walks past the end of the frame object until it finds a zero byte. With the icmsg backend the frame lives in a stack buffer of the IPC work-queue thread, so bytes of that thread's stack are rendered into the log message; with the rpmsg backends the scan continues through the shared vring memory. Impact is bounded to disclosure of a small amount of adjacent memory into the receiving domain's log sink, plus a possible fatal fault if the scan leaves a mapped region; the log packager's own -ENOSPC bound prevents the overrun from becoming a write. The fix bounds the conversion with %.*s and MIN(msg->channel_name_len, sizeof(msg->channel_name)).","categories":["Unclassified"],"product":"zephyr","vendor":"zephyrproject","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18418","source_modified_at":"2026-10-15T18:09:08.898Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"zephyr","vendor":"zephyrproject","versions":[{"lessThan":"4.4.2","status":"affected","version":"4.4.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-48w8-fjhj-r9w8","source_modified_at":"2026-10-11T16:03:17Z","fetched_at":"2026-10-24T14:26:37.433577Z","package":{"ecosystem":"other","name":"zephyr"},"range":">= 4.4.0, < 4.4.2"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18418","source_modified_at":"2026-10-15T18:09:08.898Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"zephyr","ecosystem":null},"version":"4.4.2","basis":"first unaffected version stated in the CVE record"},{"source":"GitHub Advisory Database","source_url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-48w8-fjhj-r9w8","source_modified_at":"2026-10-11T16:03:17Z","fetched_at":"2026-10-24T14:26:37.433577Z","package":{"ecosystem":"other","name":"zephyr"},"version":"4.4.2"}],"cvss":3.4,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00109,"percentile":0.01162,"score_date":"2026-10-23"},"published_at":"2026-10-11T17:15:00.221Z","modified_at":"2026-10-15T18:09:08.898Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-18418","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T18:09:08.898Z"},{"source":"GitHub Advisory Database","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-48w8-fjhj-r9w8","fetched_at":"2026-10-24T14:26:37.433577Z","source_modified_at":"2026-10-11T16:03:17Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18418","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/commit/fc065f79a568a6c6cc14b89795bd60e5eabd6f02","tags":["patch"]},{"source":"CVE List","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-48w8-fjhj-r9w8"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T17:51:25.324466Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T18:09:08.898Z","content_hash":"104abeb98350f1cbd83413c15c0f952fb082ca8c916eef3e247074a6befc2eab"}}