{"id":"CVE-2026-10848","summary":"Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)","details":"The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scanned the result with strchr(out_buf, '\"'). Because strncpy does not NUL-terminate the destination when the source is at least outlen - 1 (127) bytes long, the subsequent strchr reads past the 128-byte destination buffer into adjacent stack memory; if a \" byte is found beyond the buffer, a one-byte out-of-bounds NUL write also occurs. A related defect in extract_payload() runs strchr/strrchr over the receive buffer, which may not be NUL-terminated when a maximal-length frame fills it.\n\nThe parsed bytes come directly from the OCPP central-system server over a websocket: the reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() on each inbound DATA frame (subsys/net/lib/ocpp/ocpp.c). A malicious or compromised central server, or an on-path attacker (OCPP is commonly deployed over plain ws://), can send an RPC frame whose uid or action field is 127+ bytes with no closing quote, triggering the out-of-bounds access.\n\nThe primary impact is a remotely triggerable denial of service: the unbounded scan can fault on an unmapped page, and the stray NUL write can corrupt adjacent stack state. The over-read data is not reflected to the peer, so disclosure is limited. The feature is EXPERIMENTAL and must be explicitly enabled (CONFIG_OCPP). The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and copies the extracted uid with an explicitly NUL-terminated buffer, eliminating both over-reads.","aliases":["GHSA-jgqq-7mjj-w642"],"modified":"2026-08-04T09:25:37.974539Z","published":"2026-08-02T16:12:18.887Z","database_specific":{"cna_assigner":"zephyr","cwe_ids":["CWE-125","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10848.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"4.3.0"},{"fixed":"4.5.0"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10848.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jgqq-7mjj-w642"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10848"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"0"},{"fixed":"e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.7.99","v2.7.0-rc3","v2.7.0-rc2","v2.7.0-rc1","zephyr-v2.6.0","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","zephyr-v2.5.0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","zephyr-v2.4.0","v2.4.0","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","zephyr-v2.3.0","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","zephyr-v2.1.0","v2.1.0","zephyr-v2.2.0","v2.2.0","v2.2.0-rc3","v2.2.0-rc2","v2.2.0-rc1","v2.1.0-rc3","v2.1.0-rc2","v2.1.0-rc1","zephyr-v2.0.0","v2.0.0","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","zephyr-v1.14.0","v1.14.0","v1.14.0-rc3","v1.14.0-rc2","v1.14.0-rc1","zephyr-v1.13.0","v1.13.0","v1.13.0-rc3","v1.13.0-rc2","v1.13.0-rc1","zephyr-v1.12.0","v1.12.0","v1.12.0-rc3","v1.12.0-rc2","v1.12.0-rc1","zephyr-v1.11.0","v1.11.0","v1.11.0-rc3","v1.11.0-rc2","v1.11.0-rc1","zephyr-v1.10.0","v1.10.0","v1.10.0-rc3","v1.10.0-rc2","v1.10.0-rc1","zephyr-v1.9.0","v1.9.0","v1.9.0-rc4","v1.9.0-rc3","v1.9.0-rc2","v1.9.0-rc1","v1.8.99","zephyr-v1.5.0","v1.5.0","v1.7.99","v1.6.99","v1.5.0-rc4","v1.5.0-rc3","v1.5.0-rc2","v1.5.0-rc1","v1.5.0-rc0","zephyr-v1.4.0","v1.4.0","v1.4.0-rc3","v1.4.0-rc2","v1.4.0-rc1","zephyr-v1.3.0","v1.3.0","v1.3.0-rc2","v1.3.0-rc1","zephyr-v1.2.0","v1.2.0","v1.2.0-rc2","v1.2.0-rc1","zephyr-v1.1.0","v1.1.0","v1.1.0-rc1","zephyr-v1.0.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10848.json","vanir_signatures_modified":"2026-08-04T09:25:37Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75","target":{"file":"subsys/net/lib/ocpp/ocpp_j.c"},"deprecated":false,"digest":{"line_hashes":["264018650126525018494888583401645540743","294684071314858141477505299503743203416","29404258155594921420863585235660807187","59904716735031554895102336825054791839","319689812651145828471201425349224091817","18727654008919894289705695422602937538","207574797516267823781232146886582785866","326548357129920873029102183060481158216","43467285114959774847932347826768769929","255901780994441918446871007139958154773","280260878919913883869690162443590908020","331603108021948014029666525370742223611","75589530732040363997518315264195214996","121613420110630099755400903277030347974","133977349371889064865558258301499708542","271775705843071630477810370770642186733","307621659909766338737705588613797861414","72479146721239955829222407687736313676","161089588137947294637598932299641777355","17044363354658847011508984659286674450","143658574113244637492207458922707042299","129377269329857915680298529689128123944","311277395170173415093551932307852839098","47788694714926810115206248821603952260","97382464209207310134422749590497621170","194287513977478058258118885511227005944","85676877444849135681821407901617589440","271481345761410943738392063800319253838","5825648653571406824270787216462446067","251312235829468977415178790018864691881","314218995376759318923306023430132955266","214559761740647290803622357701460968213","305701982363245698790397550388247344805","222939546325809784698814916865369456644","330554448668397652256124752571112931794","131093635008359466380658035708282316707","295476366010788484798995279539288716330","99170596663849488985556711999961134818","288283362116363732843000501418189394558","265734145861107883218109930290098490521","80437260415104662931338156903006379845","188668048723937876591477467278855014905","80618651955192485529472322179986525307","225513748954715692486285488039428818984","27554295354530265383496727121125359253","180990837329717262326634368465443467973","133111026504523893735465330067962821678","12557799736129264814345901411451231763","238868111528539466930055708355667675318","50113668430765857201893694078975937355","314353636891203934034678522666127135740","43036194104861270457224963076286564827","187795727910485156479574534870067493271","209049396300741396488290979183097235695","268081932286107350996322633113319418508","130426510452190948665784314451885112816","156986264222689139391010250850635503314","300892873732457872066839435815183546233","191642143504324750233237155283416762884","102121938517773023208327722074850051627","158288056299695688888156820836062811771","43036194104861270457224963076286564827","332807671619583524196183216534871262841","315499016097737799055793541957665823983","229463464419087176236272487296298485468","141330702844241165070636863955605192237","92792587245422833377957328543155228888","157095731877658868750453753281642056175","178634324806717964934520659104423653404","272968329612976420452288720170171114604","34184493295967297477651112996744726402","200727504835125603082533138829013506816","158159317524350532084304512435832238075","27464818859677847316493653989782068487","159173610271164291195116308925566384940","305964654261768679779556595185499450422","60696793995521300571106006667748511581","73299225385345852874093853608600493713","286259058570221711743839933575108017794","205843041542374602702690274246688701161","239718653409973693298686696127245800738","298176824356441214070682504711865561728","210851135041723581427453439533773949555"],"threshold":0.9},"id":"CVE-2026-10848-893b8611","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"231815830535940567576203922281309218555","length":1136},"id":"CVE-2026-10848-a249b390","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75","target":{"file":"subsys/net/lib/ocpp/ocpp_j.c","function":"parse_rpc_msg"}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75","target":{"file":"subsys/net/lib/ocpp/ocpp_j.c","function":"extract_payload"},"deprecated":false,"digest":{"function_hash":"130032429423911987656395845579603573288","length":351},"id":"CVE-2026-10848-a2e8d5e7","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["259365633339181686245821660512866564633"],"threshold":0.9},"id":"CVE-2026-10848-a3b4a21d","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75","target":{"file":"subsys/net/lib/ocpp/ocpp_j.h"}},{"digest":{"function_hash":"153024857381383173874046574663558044692","length":274},"id":"CVE-2026-10848-fd5a9b88","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75","target":{"file":"subsys/net/lib/ocpp/ocpp_j.c","function":"extract_string_field"},"deprecated":false}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"}]}