{"id":"CVE-2026-10773","summary":"Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)","details":"The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char * name table after a faulty bounds check. The guard used msg_type \u003c= sizeof(name) instead of msg_type \u003c= ARRAY_SIZE(name); sizeof returns the byte size of the pointer array (32 on 32-bit, 64 on 64-bit targets) rather than the element count of 8, so message-type values from 9 up to that byte size pass the check and cause name[msg_type - 1] to read past the end of the array.\n\nThe msg_type value originates from the DHCP MESSAGE TYPE option, which is read as an unchecked raw byte from a received packet (net_pkt_read_u8) and passed unmodified into the lookup. A DHCP server, or any host able to inject a spoofed DHCP reply onto the client's link, can therefore drive the index out of bounds. The out-of-range slot yields a garbage const char * that is then dereferenced by a %s log conversion.\n\nThe lookup is reached only from a debug log statement (NET_DBG / LOG_DBG), so the out-of-bounds read is triggerable only when the DHCPv4 log module is built at DEBUG level (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), which is not the default configuration. When that condition holds, the result is an out-of-bounds read and a wild-pointer dereference: most likely a crash of the DHCP client (denial of service) and potentially disclosure of an adjacent pointer's contents through the log output. The fix replaces sizeof with ARRAY_SIZE, restoring the correct 1..8 acceptance window.","aliases":["GHSA-r5hq-xq42-wcfq"],"modified":"2026-08-03T09:25:37.797672Z","published":"2026-08-01T12:21:17.622Z","database_specific":{"cna_assigner":"zephyr","cwe_ids":["CWE-125","CWE-682"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10773.json","unresolved_ranges":[{"extracted_events":[{"introduced":"1.7.0"},{"fixed":"4.5.0"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10773.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r5hq-xq42-wcfq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10773"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/73c8a7df4f00088fc04ee5ab71bcabf47fcd3db7"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"0"},{"fixed":"73c8a7df4f00088fc04ee5ab71bcabf47fcd3db7"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.7.99","v2.7.0-rc3","v2.7.0-rc2","v2.7.0-rc1","zephyr-v2.6.0","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","zephyr-v2.5.0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","zephyr-v2.4.0","v2.4.0","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","zephyr-v2.3.0","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","zephyr-v2.1.0","v2.1.0","zephyr-v2.2.0","v2.2.0","v2.2.0-rc3","v2.2.0-rc2","v2.2.0-rc1","v2.1.0-rc3","v2.1.0-rc2","v2.1.0-rc1","zephyr-v2.0.0","v2.0.0","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","zephyr-v1.14.0","v1.14.0","v1.14.0-rc3","v1.14.0-rc2","v1.14.0-rc1","zephyr-v1.13.0","v1.13.0","v1.13.0-rc3","v1.13.0-rc2","v1.13.0-rc1","zephyr-v1.12.0","v1.12.0","v1.12.0-rc3","v1.12.0-rc2","v1.12.0-rc1","zephyr-v1.11.0","v1.11.0","v1.11.0-rc3","v1.11.0-rc2","v1.11.0-rc1","zephyr-v1.10.0","v1.10.0","v1.10.0-rc3","v1.10.0-rc2","v1.10.0-rc1","zephyr-v1.9.0","v1.9.0","v1.9.0-rc4","v1.9.0-rc3","v1.9.0-rc2","v1.9.0-rc1","v1.8.99","zephyr-v1.5.0","v1.5.0","v1.7.99","v1.6.99","v1.5.0-rc4","v1.5.0-rc3","v1.5.0-rc2","v1.5.0-rc1","v1.5.0-rc0","zephyr-v1.4.0","v1.4.0","v1.4.0-rc3","v1.4.0-rc2","v1.4.0-rc1","zephyr-v1.3.0","v1.3.0","v1.3.0-rc2","v1.3.0-rc1","zephyr-v1.2.0","v1.2.0","v1.2.0-rc2","v1.2.0-rc1","zephyr-v1.1.0","v1.1.0","v1.1.0-rc1","zephyr-v1.0.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10773.json","vanir_signatures_modified":"2026-08-03T09:25:37Z","vanir_signatures":[{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/73c8a7df4f00088fc04ee5ab71bcabf47fcd3db7","target":{"file":"subsys/net/lib/dhcpv4/dhcpv4.c","function":"net_dhcpv4_msg_type_name"},"deprecated":false,"digest":{"function_hash":"277616193722099052102066602920969727166","length":267},"id":"CVE-2026-10773-4d48446d","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/73c8a7df4f00088fc04ee5ab71bcabf47fcd3db7","target":{"file":"subsys/net/lib/dhcpv6/dhcpv6.c"},"deprecated":false,"digest":{"line_hashes":["24770291691023861843515758847361872923","52351945230979009086833437114057355425","208899030713602348851963383174812063020","311882597654240901332562886749590494174"],"threshold":0.9},"id":"CVE-2026-10773-7472c081","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"199462793810771570454438086193270188232","length":294},"id":"CVE-2026-10773-7a3a403d","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/73c8a7df4f00088fc04ee5ab71bcabf47fcd3db7","target":{"file":"subsys/net/lib/dhcpv6/dhcpv6.c","function":"net_dhcpv6_state_name"}},{"digest":{"function_hash":"198147319299416108696269693901821504765","length":278},"id":"CVE-2026-10773-b44d457c","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/73c8a7df4f00088fc04ee5ab71bcabf47fcd3db7","target":{"file":"subsys/net/lib/dhcpv4/dhcpv4.c","function":"net_dhcpv4_state_name"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/73c8a7df4f00088fc04ee5ab71bcabf47fcd3db7","target":{"file":"subsys/net/lib/dhcpv4/dhcpv4.c"},"deprecated":false,"digest":{"line_hashes":["23335669069177508657646137664929796357","186531158475003782121245424815783129744","208899030713602348851963383174812063020","254158629952562727888401640967514754036","216858646669899283477225869625883304658","48204210771004814656221013307187423543","69943021843060942512544381625143740980","194606497994712708314689398441959585556"],"threshold":0.9},"id":"CVE-2026-10773-bb51621c"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}]}