CVE-2026-5071: zephyrproject-rtos zephyr Out-of-bounds Read

Vulnerability summary

CVE-2026-5071 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in zephyrproject-rtos zephyr. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-05-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.