A critical vulnerability in the Zephyr RTOS allows unauthenticated attackers on the local network to trigger memory corruption or system instability due to missing input sanitization.

This flaw is classified as CWE-130, representing improper handling of length parameter inconsistency. The vulnerability is reachable by an unauthenticated attacker positioned on the adjacent network (AV:A), who can trigger the flaw to cause high impact on system availability.

The exploitation of this vulnerability can lead to significant system instability or denial of service, which is particularly concerning for critical infrastructure and embedded systems running Zephyr. With a CVSS score of 7.6, the vulnerability is classified as High, reflecting the risk to system integrity and availability in environments where Zephyr is deployed.

Immediate Action: Organizations should update to the version of Zephyr RTOS that includes the security fix provided by the vendor, as referenced in the official GitHub advisory.

Proactive Monitoring: Security teams should monitor network traffic for anomalous length parameters or unexpected device reboots that may indicate exploitation attempts.

Compensating Controls: Implement strict network segmentation to isolate devices running Zephyr from untrusted network segments, thereby limiting the attack surface to the local network.

Public Exploit Available: Unknown

Given the potential for denial of service and system disruption, it is imperative that developers and system integrators verify their current Zephyr RTOS version. Projects utilizing affected versions should move to apply the necessary security patches immediately to protect against potential exploitation of this memory-handling flaw.