{"id":"CVE-2026-5071","title":"The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame()","summary":"The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production bui…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-125"],"vendor":"zephyrproject","product":"zephyr","affected":["zephyr <= 4.3.0"],"published":"2026-05-30","updated":"2026-10-15","sourceUpdated":"2026-10-15T23:17:37.643","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-5071","references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3w6-x7m3-3c58","label":"vulnerabilities@zephyrproject.org"}],"tags":["nvd","cve.org"],"epss":0.00167,"epssPercentile":0.05925,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-01T13:51:23.839460Z"},"ingestedAt":"2026-10-15T22:48:25.575Z","slug":"CVE-2026-5071","body":"## Overview\n\nThe SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.\n\n## Affected\n\n- `zephyr <= 4.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}