# CVE-2026-12634: Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

Status: published. Published: 2026-08-19. Updated: 2026-11-04.

The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with buf[rc] = '\0', where rc is the return value of nvs_read(). Per its contract, nvs_read() returns the full stored entry length (wlk_ate.len), which can exceed the supplied buffer length — only MIN(len, stored_len) bytes are actually copied, but the return value may be much larger, bounded only by the NVS sector size. Three sites (settings_nvs_cache_match(), settings_nvs_load(), and settings_nvs_save()) used this value directly as the NUL index without clamping, so an oversized stored name entry causes a single \0 byte to be written past the end of the stack buffer at an attacker-influenced offset (CWE-787).

The oversized entry cannot arise through the normal settings API, where names are bounded by SETTINGS_MAX_NAME_LEN. It requires an actor able to write the flash that backs the settings partition — a co-resident or untrusted component sharing the flash device, a malicious settings image/restore, or offline/physical flash access (a shared-flash threat model). The malformed entry is parsed when settings_load() runs at boot or subsystem init, or during settings_save().

The out-of-bounds write is a single NUL byte at an offset equal to the crafted entry length (up to the NVS sector size), so the practical impact is a crash or denial of service and limited stack corruption rather than reliable code execution. There is no confidentiality impact, and the path is not reachable from the network through the ordinary settings interface. The fix skips any entry whose nvs_read() length is greater than or equal to the buffer size before performing the NUL store.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: zephyr) — https://github.com/zephyrproject-rtos/zephyr/commit/e79a0db70fc9ad33982f9786b428b115a78eaadd

## Affected products and versions

- zephyrproject / zephyr (zephyr): ≥ 2.0.0; < 4.3.2 (affected, semver); ≥ 4.4.0; < 4.5.0 (affected, semver). Source: CNA: zephyr

## Severity and prioritization

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H; source: CNA: zephyr

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H; source: NVD: vulnerabilities@zephyrproject.org

- CISA KEV: No listing in collected sources

- EPSS: 0.14% as of 2026-11-03; percentile 3.13%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-787

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/zephyrproject-rtos/zephyr/commit/e79a0db70fc9ad33982f9786b428b115a78eaadd (CNA: zephyr; patch)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-q7c8-m2qg-385c (CNA: zephyr)

- https://github.com/zephyrproject-rtos/zephyr/commit/e79a0db70fc9ad33982f9786b428b115a78eaadd (vulnerabilities@zephyrproject.org)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-q7c8-m2qg-385c (vulnerabilities@zephyrproject.org)

## Provenance

- CNA: zephyr: https://www.cve.org/CVERecord?id=CVE-2026-12634; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12634; retrieved 2026-11-04; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-12634; retrieved 2026-11-04; source updated Not reported

Revision: d5a40dcbdd0292c1b91fc1e654f733ac828b453ef8798bd29f82531c1542c871

Canonical: https://y2.dev/cve/CVE-2026-12634

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.