{"id":"CVE-2026-18418","revision":"4243b41362bf4be78ed45b43a1fab369","records":[{"revision":"4243b41362bf4be78ed45b43a1fab369","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-18418","aliases":[],"title":"Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name","description":"The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport guarantees the array is NUL-terminated. The only code that verifies termination is zbus_proxy_agent_receive_cb() in subsys/zbus/proxy_agent/zbus_proxy_agent.c, which rejects the frame in precisely those cases — so the warning printed a non-terminated buffer exactly on the error paths where the name had been found invalid (or, for an invalid message_size, had not been inspected at all).\n\nAny peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it, by sending a frame with an out-of-range message_size or with channel_name[] containing no NUL byte. Reaching the code requires CONFIG_ZBUS_PROXY_AGENT_IPC and logging built at warning level or above (the default), and requires control over the firmware of the peer domain — typically a second core on the same SoC.\n\nThe resulting strlen() inside the log packager walks past the end of the frame object until it finds a zero byte. With the icmsg backend the frame lives in a stack buffer of the IPC work-queue thread, so bytes of that thread's stack are rendered into the log message; with the rpmsg backends the scan continues through the shared vring memory. Impact is bounded to disclosure of a small amount of adjacent memory into the receiving domain's log sink, plus a possible fatal fault if the scan leaves a mapped region; the log packager's own -ENOSPC bound prevents the overrun from becoming a write. The fix bounds the conversion with %.*s and MIN(msg->channel_name_len, sizeof(msg->channel_name)).","state":0,"publishedAt":"2026-10-11T17:15:00.221+00:00","modifiedAt":"2026-10-15T18:09:08.898+00:00","affected":[{"ecosystem":"https://github.com/zephyrproject-rtos/zephyr","name":"zephyr","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"zephyrproject\",\n                    \"product\": \"zephyr\",\n                    \"collectionURL\": \"https://github.com/zephyrproject-rtos/zephyr\",\n                    \"packageName\": \"zephyr\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"programFiles\": [\n                        \"subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"zbus_proxy_agent_ipc_recv_callback\"\n                        }\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.4.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"4.4.2\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","score":3.4,"severity":"LOW"}],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/fc065f79a568a6c6cc14b89795bd60e5eabd6f02","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-48w8-fjhj-r9w8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-18418","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-18418","identifiers":["CVE-2026-18418"]},"retained":false,"historicalAffected":[]}],"coverage":[]}