CVE-2026-10848 - Out-of-bounds Read in Zephyr OCPP 1.6 RPC Message Parser

CVE-2026-10848 - Out-of-bounds Read in Zephyr OCPP 1.6 RPC Message Parser

Published Date: August 2, 2026
Source: CVE Feed

CVE-2026-10848 describes an out-of-bounds read vulnerability in the Zephyr OCPP 1.6 RPC message parser. The OCPP 1.6 client in subsys/net/lib/ocpp parses inbound WAMP RPC frames using a hand-rolled helper, extract_string_field(). This function copies the message’s uid and action fields but fails to properly null-terminate the destination buffer when the source is at least outlen - 1 bytes long. This oversight can lead to a denial of service due to unbounded scanning that may fault on an unmapped page.

Vulnerability Details

• Remotely Exploit: Yes!
• Last Modified: August 2, 2026, 5:16 p.m.

Solution

To mitigate this vulnerability, it is recommended to replace manual string parsing with a bounds-respecting JSON parser. The fix involves using json_mixed_arr_parse() to ensure that the extracted uid is null-terminated, thus eliminating the risk of over-reads.

For more information, you can read the complete article here: Read full article 🚀