CVE-2026-0849 - crypto: ATAES132A response length allows stack buffer overflow

Back Back to CVE browser

MEDIUM

crypto: ATAES132A response length allows stack buffer overflow

Published Mar 14, 2026

6.8

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.

Affected products

Vendor Zephyrproject-Rtos Product Zephyr Default
unaffected
Affected
- ≤ 4.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Zephyrproject-Rtos	Zephyr	unaffected	Affected ≤ 4.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12186
Advisory
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-ff4p-3ggg-prp6
exploitPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12186		Advisory
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-ff4p-3ggg-prp6		exploitPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner zephyr

Published Mar 14, 2026

Updated Mar 17, 2026

Reserved Jan 11, 2026

Link CVE-2026-0849

CISA Vulnrichment

Updated Mar 17, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-0849

Red Hat

No data

ENISA EUVD

Assigner zephyr

Published Mar 14, 2026

Updated Mar 17, 2026

Link EUVD-2026-12186

GitHub

No data