CVE-2026-14368: Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
The LwM2M JSON content formatter's getstring() in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if (stringlength > buflen), which accepts a string whose length is exactly buflen. After memcpy() fills the whole buffer, buf[stringlength] = '\0' then writes one byte past the end of the buffer (CWE-787).
The string value and its length are taken directly from the incoming CoAP payload during a LwM2M WRITE: dowriteopjson() parses the payload obtained from coappacketgetpayload(), and getstring() is invoked from lwm2mwritehandler() (enginegetstring() in subsys/net/lib/lwm2m/lwm2mmessagehandling.c) for a LWM2MRESTYPESTRING resource. The destination buf/buflen is either the resource instance's fixed data buffer (resinst->dataptr/maxdatalen) or the engine validation buffer (msg->ctx->validatebuf). A LwM2M server (the client's DTLS peer) can therefore write a string resource with a value whose length equals the target buffer size and force a one-byte overflow.
The overflow is a single out-of-bounds write of the constant byte 0x00 immediately past the resource or validation buffer, corrupting the adjacent byte in memory. It is not an information leak and the written value is fixed, so it is not a direct code-execution primitive, but it can corrupt adjacent state (an adjacent resource value, a length/flag field, or a struct field) and cause data corruption or a crash. Triggering the write is deterministic; the resulting impact depends on memory layout.
The fix changes the guard to stringlength >= buflen, rejecting the exact-length case and aligning the JSON formatter with the other content formatters (lwm2mrwplaintext.c, lwm2mrwomatlv.c, lwm2mrwsenmljson.c, lwm2mrwcbor.c, lwm2mrwsenmlcbor.c), which already used the correct boundary check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In get_string() within subsys/net/lib/lwm2m/lwm2m_rw_json.c, update the destination buffer length check so that the exact-length case is rejected: replace the current guard if (string_length > buflen) with if (string_length >= buflen) before performing buf[string_length] = '\0'.
Zephyr LwM2M JSON string parser (subsys/net/lib/lwm2m/lwm2m_rw_json.c) get_string() length guard = Change condition from (string_length > buflen) to (string_length >= buflen)
Event History
Frequently Asked Questions
Who would need to be trusted or compromised to exploit this issue?
The attacker must be able to act as the LwM2M client's server, specifically its DTLS peer, and send an LwM2M WRITE request. The attack is network-reachable but requires low privileges.
What resource types and message format are involved?
The vulnerable path is used for LWM2M_RES_TYPE_STRING resources when processing LwM2M WRITE operations encoded with the JSON content formatter. A payload string whose length exactly matches the destination buffer size triggers the out-of-bounds NUL write.
What is the immediate effect of a successful write?
The overflow writes exactly one byte, the constant value 0x00, immediately after the resource data buffer or engine validation buffer. The stated impact is limited integrity and availability impact; no confidentiality impact is described.