CVE-2026-1681: zephyrproject-rtos zephyr Uncontrolled Recursion

Vulnerability summary

CVE-2026-1681 is a medium (CVSS 6.1) Uncontrolled Recursion vulnerability in zephyrproject-rtos zephyr. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-05-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the destination is recognized as a local address, both the echo request and the resulting echo reply are processed inline before the current frame returns. The nested input-path frames exceed the work-queue stack and trigger a stack overflow.

• CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.