CVE-2026-10848

Zephyr RTOS's experimental OCPP 1.6 client contains an out-of-bounds read and a potential one-byte out-of-bounds write in its inbound RPC message parser, caused by a hand-rolled strncpy-based extractor that can leave the 128-byte stack buffer unterminated so a subsequent strchr scans past it. A malicious or compromised OCPP central-system server, or any on-path attacker when OCPP is deployed over unencrypted ws://, can trigger the flaw by sending an RPC frame whose uid or action field is 127+ bytes with no closing quote, or by filling the receive buffer with a maximal-length frame. The primary impact is a remotely triggerable denial of service, since the unbounded scan can fault on an unmapped page and the stray NUL write can corrupt adjacent stack state; confidentiality impact is limited because the over-read bytes are not reflected to the peer. Only Zephyr builds that explicitly enable the experimental OCPP subsystem (CONFIG_OCPP), typically OCPP 1.6 charge-point or charging-infrastructure prototypes, are affected. No exploitation has been reported in the wild: the EPSS probability is low (0.3%), the flaw is not in CISA KEV, and a public reference exists in the Zephyr security advisory GHSA-jgqq-7mjj-w642.

What to do: Check Zephyr security advisory GHSA-jgqq-7mjj-w642 for the affected and fixed version ranges and upgrade to a Zephyr release containing the rewritten parser, which uses bounds-respecting json_mixed_arr_parse() and an explicitly NUL-terminated uid copy. If OCPP is not required, disable CONFIG_OCPP; if it is, use wss:// (TLS) with trusted central systems to remove the on-path attack vector. Audit whether any deployed charge-point or charging-infrastructure builds enable the experimental OCPP client and are reachable from untrusted networks.