CVE-2026-5066: net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function
A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/socketstls.c). When the TLS session cache is enabled, tlssessionstore() and tlssessionrestore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. struct netsockaddr is an opaque type, so an application can pass an addrlen larger than sizeof(struct netsockaddr) (for example 128 bytes into a 24-byte stack buffer), causing the memcpy to read and write past the end of the address memory used by the TLS session cache. This out-of-bounds write can lead to a crash and denial of service, and potentially to arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5066?
The severity of CVE-2026-5066 is rated as medium with a score of 6.3.
What does CVE-2026-5066 affect?
CVE-2026-5066 affects the TLS socket connect path in the network sockets subsystem of the Zephyr Project RTOS.
How do I fix CVE-2026-5066?
To fix CVE-2026-5066, you should apply the latest security updates from the Zephyr Project.
What vulnerabilities does CVE-2026-5066 introduce?
CVE-2026-5066 introduces potential out-of-bounds write/read issues due to improper memory handling in socket operations.
Is CVE-2026-5066 exploitable remotely?
Yes, CVE-2026-5066 can be exploited remotely, given the network socket context.