CVE-2026-0849: crypto: ATAES132A response length allows stack buffer overflow
Published Mar 14, 2026
·Updated
Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.
Affected Software
5 affected components
Zephyr Zephyr
zephyrproject zephyr=4.3.0
zephyrproject zephyr=4.3.0-rc1
zephyrproject zephyr=4.3.0-rc2
zephyrproject zephyr=4.3.0-rc3
Remediation
Event History
Mar 14, 2026
CVE Published
via MITRE·09:05 PM
Data Sourced
via MITRE·09:05 PM
DescriptionSeverityWeakness
Mar 16, 2026
Data Sourced
via NVD·02:18 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-0849?
CVE-2026-0849 is identified as a critical severity vulnerability due to the potential for kernel memory corruption.
2
How do I fix CVE-2026-0849?
To fix CVE-2026-0849, update the Zephyr Zephyr version to the latest patch that addresses this vulnerability.
3
Who is affected by CVE-2026-0849?
Devices using the Zephyr crypto driver that process malformed ATAES132A responses are affected by CVE-2026-0849.
4
What are the consequences of CVE-2026-0849?
Exploitation of CVE-2026-0849 may lead to hijacking of execution and potentially allow attackers to control vulnerable devices.
5
When was CVE-2026-0849 discovered?
CVE-2026-0849 was reported and made publicly known in 2026.