Key points
- CVE-2026-76788 affects Zephyr versions up to 4.4.2 with a CVSS score of 8.8.
- The vulnerability exists in the OSDP Control Panel reply parser within the Zephyr RTOS.
- Attackers can exploit the flaw via the RS-485 bus without needing authentication credentials.
The Zephyr real-time operating system contains a critical parsing flaw that allows remote attackers to potentially hijack control flow on embedded access control panels. This defect, tracked as CVE-2026-76788, affects all Zephyr versions up to 4.4.2 and enables stack buffer overflows through the Open Supervised Device Protocol (OSDP) interface.
The vulnerability resides in the `cp_decode_response()` function, which processes replies from peripheral devices like card readers. According to the National Vulnerability Database, the parser fails to validate payload lengths for specific reply types, allowing malicious data to overwrite stack memory. This lack of bounds checking permits an attacker to write roughly 180 bytes of chosen data past the intended buffer.
Technical details of the flaw
The issue occurs when the parser handles `REPLY_KEYPPAD` or `REPLY_RAW` messages. The code accepts the length field declared in the received frame without verifying it against the maximum allowed size. A subsequent `memcpy()` operation then copies this unchecked data into fixed 64-byte arrays, causing a stack overflow. This defect is distinct from other handlers in the same switch statement that already included proper length bounds.
Who is affected
Any system using Zephyr with `CONFIG_OSDP` and `CONFIG_OSDP_MODE_CP` enabled is vulnerable. The attack surface includes physical access to the RS-485 wiring or compromised peripheral devices. An attacker does not need to authenticate; they can inject frames with valid checksums and sequence numbers to trigger the overflow. Even if secure channels are enabled, a single bad MAC can disable security, allowing plaintext exploitation.
Next steps
The source material describes a fix that adds strict length bounds to the affected handlers, capping each `memcpy()` at the size of its destination. However, no patched version has been confirmed as released yet. Administrators should monitor for official updates from the Zephyr project. Until a fix is confirmed, systems remain exposed to potential control-flow hijacking or hard crashes on the OSDP receive thread.
Signals worth monitoring
Teams usually detect this activity by reviewing RS-485 bus traffic for oversized frames or unexpected resets on control panels. Check whether peripheral devices are sending replies that exceed standard length limits. Monitor system logs for sudden crashes or unhandled exceptions in the OSDP thread. Look for anomalies in sequence numbers or CRC checks that might indicate injected frames. Containment moves include isolating affected panels from the bus and verifying firmware versions.
What to do and how to stay safe: Zephyr
- Audit all Zephyr-based access control panels for versions prior to 4.4.2.
- Inspect RS-485 bus traffic for frames with suspicious payload lengths.
- Ensure peripheral devices are physically secured to prevent tampering.
- Plan to update firmware once the vendor provides an update.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-76788?
The CVSS score is 8.8, which is rated as high severity.
Which Zephyr versions are affected by this vulnerability?
All Zephyr versions up to and including 4.4.2 are affected.
Can this vulnerability be exploited remotely?
Yes, anyone with access to the RS-485 wiring or a compromised peripheral device can exploit it.
