The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settingsnvs.c) reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with buf[rc] = '\0', where rc is the return value of nvsread(). Per its contract, nvsread() returns the full stored entry length (wlkate.len), which can exceed the supplied buffer length — only MIN(len, storedlen) bytes are actually copied, but the return value may be much larger, bounded only by the NVS sector size. Three sites (settingsnvscachematch(), settingsnvsload(), and settingsnvssave()) used this value directly as the NUL index without clamping, so an oversized stored name entry causes a single \0 byte to be written past the end of the stack buffer at an attacker-influenced offset (CWE-787).

The oversized entry cannot arise through the normal settings API, where names are bounded by SETTINGSMAXNAMELEN. It requires an actor able to write the flash that backs the settings partition — a co-resident or untrusted component sharing the flash device, a malicious settings image/restore, or offline/physical flash access (a shared-flash threat model). The malformed entry is parsed when settingsload() runs at boot or subsystem init, or during settingssave().

The out-of-bounds write is a single NUL byte at an offset equal to the crafted entry length (up to the NVS sector size), so the practical impact is a crash or denial of service and limited stack corruption rather than reliable code execution. There is no confidentiality impact, and the path is not reachable from the network through the ordinary settings interface. The fix skips any entry whose nvsread() length is greater than or equal to the buffer size before performing the NUL store.