CVE-2026-18416 | ZephyrProject Zephyr up to 4.4.1 CoAP Link-Format Helper coap_link_format.c match_path_uri out-of-bounds

September 28, 2026 Yanac

A vulnerability classified as critical has been found in ZephyrProject Zephyr up to 4.4.1. Affected is the function match_path_uri of the file subsys/net/lib/coap/coap_link_format.c of the component CoAP Link-Format Helper. The manipulation leads to out-of-bounds read.

This vulnerability is traded as CVE-2026-18416. It is possible to initiate the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More