{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","product":"zephyr","source":"CNA: zephyr","vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"2.4.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"cveId":"CVE-2026-76787","cwes":["CWE-476"],"description":"The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehub.c). The decoder treats every descriptor field as optional — json_obj_parse() returns a bitmask of the fields it actually decoded and never fails on a missing one — so a response that omits the \"sha256sum\" string leaves the corresponding const char * in the zero-initialised struct resp_probe_any_boards / struct resp_probe_some_boards at NULL. Both metadata branches then computed sha256size = strlen(...objects.sha256sum) + 1 before any validation, dereferencing that NULL pointer; the SHA256_HEX_DIGEST_SIZE test that follows operates on a value the bad read has already produced and cannot prevent it.\n\nThe metadata is supplied entirely by the network peer: probe_cb() accepts the datagram, runs coap_packet_parse() and copies the payload with no token matching and no cryptographic check. With CONFIG_UPDATEHUB_DTLS unset — the default — start_coap_client() uses plain CoAP over UDP on port 5683 with no peer authentication and resolves the server via unauthenticated DNS, so an on-path attacker, a DNS spoofer, or an off-path attacker who wins the race with a forged source address can deliver the malformed metadata. A probe response as simple as \"objects\":[[{}],[{}]] suffices, and no user interaction is required because updatehub_autohandler() polls on CONFIG_UPDATEHUB_POLL_INTERVAL. When CONFIG_UPDATEHUB_DTLS=y the trigger narrows to a malicious or compromised update server.\n\nThe primitive is a read at address zero, not a write, so the impact is availability only. On targets where the low address range is unmapped or protected — MMU-based architectures, builds with CONFIG_NULL_POINTER_EXCEPTION_DETECTION_DWT/_MPU/_PMP, TrustZone non-secure images, and SoCs such as nRF54L whose 0x0–0x400 window is unmapped — the load faults and Zephyr's default fatal handler halts the system, giving a remotely re-triggerable denial of service on every poll. On classic Cortex-M targets where the vector table is readable at address zero the walk usually terminates immediately and the request is rejected by the length check, so the outcome is configuration- and SoC-dependent. There is no memory write, and the copied bytes are only compared against the locally computed image hash, so there is no information-disclosure channel.\n\nThe fix adds an explicit sha256sum == NULL test that returns UPDATEHUB_METADATA_ERROR ahead of the strlen() in both metadata branches. Debug builds (CONFIG_UPDATEHUB_LOG_LEVEL=4) still format the same pointers with %s in a LOG_DBG() loop that runs before the new checks, so that variant remains in debug configurations only.","epss":{"date":"2026-11-03","percentile":0.30098,"score":0.00362},"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: zephyr","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":5.9,"severity":"medium","source":"NVD: vulnerabilities@zephyrproject.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793769540983,"publishedAt":1792442360425,"references":[{"source":"CNA: zephyr","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/6fc4f27a74021b52c509e4f7912d68145dfa7728"},{"source":"CNA: zephyr","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-82gq-cmqw-xgx2"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/6fc4f27a74021b52c509e4f7912d68145dfa7728"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-82gq-cmqw-xgx2"}],"remediation":[{"kind":"fix","source":"CNA: zephyr","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/zephyrproject-rtos/zephyr/commit/6fc4f27a74021b52c509e4f7912d68145dfa7728"}],"revision":"7796637d42ee716b0d9eb3febcd250ddf3b419d8dee60ba8cd791a5fc3d48e1d","sources":[{"modifiedAt":1793768471074,"name":"CNA: zephyr","retrievedAt":1793772770592,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76787"},{"modifiedAt":1793769540983,"name":"NVD","retrievedAt":1793772982232,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76787"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793772771175,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76787"}],"ssvc":{"assessedAt":1792519476017,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum","updatedAt":1793772982232}