CVE-2026-5066: net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

Published Jun 4, 2026
·
Updated

A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/socketstls.c). When the TLS session cache is enabled, tlssessionstore() and tlssessionrestore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. struct netsockaddr is an opaque type, so an application can pass an addrlen larger than sizeof(struct netsockaddr) (for example 128 bytes into a 24-byte stack buffer), causing the memcpy to read and write past the end of the address memory used by the TLS session cache. This out-of-bounds write can lead to a crash and denial of service, and potentially to arbitrary code execution.

Affected Software

2 affected components
Zephyr Project Zephyr RTOS
zephyrproject zephyr<=4.3.0

Event History

Jun 4, 2026
CVE Published
via MITRE·08:31 PM
Data Sourced
via MITRE·08:31 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-5066?

The severity of CVE-2026-5066 is rated as medium with a score of 6.3.

2

What does CVE-2026-5066 affect?

CVE-2026-5066 affects the TLS socket connect path in the network sockets subsystem of the Zephyr Project RTOS.

3

How do I fix CVE-2026-5066?

To fix CVE-2026-5066, you should apply the latest security updates from the Zephyr Project.

4

What vulnerabilities does CVE-2026-5066 introduce?

CVE-2026-5066 introduces potential out-of-bounds write/read issues due to improper memory handling in socket operations.

5

Is CVE-2026-5066 exploitable remotely?

Yes, CVE-2026-5066 can be exploited remotely, given the network socket context.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203