CVE-2026-18418

Executive Summary

CVE-2026-18418 is an out-of-bounds read in the Zephyr RTOS zbus proxy agent IPC backend (subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c). A peer domain able to place a crafted struct zbus_proxy_msg frame on the bound ipc_service endpoint can force a non‑NUL‑terminated channel_name[] buffer into a %s log conversion, causing strlen() to walk past the end of the frame and render adjacent memory into the log output. Impact is bounded to local information disclosure and minor availability degradation (CVSS 3.4, AV:L), with the primary exposure being leakage of IPC work‑queue thread stack bytes (icmsg backend) or shared vring memory (rpmsg backends).

Technical Analysis

The defect is a classic unsafe string handling condition (CWE-125, out‑of‑bounds read) in the zbus proxy agent IPC backend. Per the NVD description, the relevant source file is subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c. On rejecting an inter‑domain frame, the backend logs the frame's channel name using a plain %s conversion specifier.

The frame structure struct zbus_proxy_msg carries a fixed‑size channel_name[] array as its last member. Critically, the transport layer provides no guarantee that this array is NUL‑terminated. The only component that validates termination is zbus_proxy_agent_receive_cb() in subsys/zbus/proxy_agent/zbus_proxy_agent.c. That callback rejects the frame in exactly the cases where the channel name is invalid — meaning the warning path logs a non‑terminated buffer precisely when the name has already been determined invalid. For the invalid message_size case, the name is not inspected at all before being logged.

The root cause chain is:

1. A peer domain sends a frame of sizeof(struct zbus_proxy_msg) bytes over the bound ipc_service endpoint.
2. The frame either carries an out‑of‑range message_size or a channel_name[] containing no NUL byte.
3. zbus_proxy_agent_receive_cb() rejects the frame due to the invalid name (or the invalid message_size prevents inspection of the name).
4. The rejection handler logs the channel name with %s.
5. The logging subsystem's packager calls strlen() on the buffer, which continues past the end of the frame object until it encounters a zero byte.

The consequences of step 5 depend on the IPC backend:

• With the icmsg backend, the frame resides in a stack buffer belonging to the IPC work‑queue thread. The out‑of‑bounds scan renders bytes of that thread's stack into the log message.
• With the rpmsg backends, the scan continues through shared vring memory.

Reachability constraints are explicit: the code path requires CONFIG_ZBUS_PROXY_AGENT_IPC compiled in and logging built at warning level or above (the default). It further requires control over the firmware of the peer domain — typically a second core on the same SoC. The attack surface is therefore an inter‑processor (inter‑domain) IPC boundary rather than a network-facing interface, which is consistent with the CVSS AV:L metric.

The bug is a logging-path information disclosure with a secondary availability component (C:L, A:L). Because the affected buffer is adjacent to live stack or shared ring memory, the leaked bytes may contain pointers, state data, or other kernel/thread context. No integrity impact is described. The CVE is currently unpatched (patch confidence 0/4), and no public PoC, Nuclei template, or exploit code exists as of this report.

Exploitation Scenarios

No public proof‑of‑concept exists for CVE-2026-18418. The following chain is inferred from the vulnerability class (out‑of‑bounds read via unterminated logging of a fixed‑size IPC frame field) and the explicit constraints in the NVD description. All named functions, structures, file paths, and configuration symbols below are taken verbatim from that description.

1. Reconnaissance / target identification. An adversary with the ability to run or influence firmware on a peer domain (typically a second CPU core on the same SoC) identifies a target where CONFIG_ZBUS_PROXY_AGENT_IPC is enabled and logging is built at warning level or above (the default). The attacker must be able to place frames on the bound ipc_service endpoint. This is a local/adjacent‑domain precondition, not a remote network condition.

2. Triggering the flaw class. The attacker crafts a frame whose total size is exactly sizeof(struct zbus_proxy_msg). Two trigger variants are described:

   • Invalid message_size: the frame carries an out‑of‑range message_size. The code path rejects the frame, but because message_size was invalid the channel_name[] was never inspected — so an unterminated or arbitrary name is logged.
   • Unterminated channel_name[]: the channel_name[] array contains no NUL byte anywhere within the fixed‑size array. zbus_proxy_agent_receive_cb() rejects the frame precisely because the name is invalid, and the rejection warning logs the non‑terminated buffer. Either variant reaches the same sink: a %s conversion on a buffer with no guaranteed terminator.

3. Payload / execution method (vulnerability‑class level). No code execution is performed. The "payload" is the malformed IPC frame itself. The observable effect is triggered inside the logging packager, where strlen() is invoked on the channel_name[] buffer. Because the buffer is the last member of the frame object and is not guaranteed NUL‑terminated, the length computation walks past the frame boundary. Exploitation is a matter of repeatedly sending such frames and capturing the resulting log output — a memory‑disclosure primitive. There is no write, no control‑flow hijack, and no injection primitive described.

4. Post‑exploitation impact. The retrieved log lines contain bytes beyond the frame:

   • icmsg backend: bytes of the IPC work‑queue thread's stack.
   • rpmsg backends: contents continuing through shared vring memory. The attacker gains the ability to harvest whatever sensitive data resides in those regions and is captured before a zero byte terminates the string. Because log output is limited/truncated, the disclosure is partial and non‑deterministic. Secondary availability impact is minor (A:L) and bounded to the affected logging path. There is no described lateral movement, persistence, or privilege escalation from this CVE alone; however, leaked stack or ring contents may support later, separate attacks.

Impact Assessment

CVSS v3.1 base score 3.4 (Low) with vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L.

• AV:L (Local): The vulnerability is reachable only from a peer domain on the same device — typically a second core on the same SoC — via the bound ipc_service endpoint. It is not remotely exploitable over a network stack.
• AC:L (Low): No special timing or race condition is described; a correctly sized frame of sizeof(struct zbus_proxy_msg) bytes with an out‑of‑range message_size or an unterminated channel_name[] reliably reaches the sink on the error path.
• PR:H (High): The attacker requires control over the firmware of the peer domain. This is a significant privilege/positional requirement, which is the principal reason the score is low.
• UI:N (None): No user interaction is required.
• S:U (Unchanged): The vulnerable component is the Zephyr zbus proxy agent IPC backend; the impact does not cross a security scope boundary as scored.
• C:L (Low): Information disclosure is limited to whatever memory the strlen() scan renders into the log message — IPC work‑queue thread stack bytes (icmsg) or shared vring contents (rpmsg).
• I:N (None): No integrity impact is described.
• A:L (Low): A minor availability component is present, bounded to the affected logging/rejection path.

Affected systems: Embedded and IoT devices running Zephyr RTOS with the zbus proxy agent IPC backend compiled in (CONFIG_ZBUS_PROXY_AGENT_IPC) and logging at warning level or above. Multi‑core SoCs where a peer domain's firmware is not fully trusted are most exposed.

Blast radius: Scope is confined to the local device's inter‑domain IPC boundary. However, because the exposed data includes stack and shared ring memory, leaked material could contain addresses or state useful for chaining with other vulnerabilities. No affected version list, OSV package mapping, or Shodan‑exposed fleet data is available, so precise fleet sizing is not possible. CISA KEV status is NO and there is no evidence of in‑the‑wild exploitation.

Detection Guidance

Detections focus on the observable symptom: warning‑level log entries produced by the zbus proxy agent IPC rejection path containing abnormally long or non‑printable channel‑name strings, and on anomalous IPC frame traffic at the inter‑domain boundary.

Sigma Rule

title: Zephyr zbus Proxy Agent IPC Rejection With Non-Terminated Channel Name (CVE-2026-18418)
id: 7c1f4a92-0d3e-4b6a-9f21-zbus18418a
status: experimental
description: Detects warning-level log entries from the Zephyr zbus proxy agent IPC backend indicating a rejected inter-domain frame, potentially caused by an unterminated channel_name[] triggering an out-of-bounds read in strl en()
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18418
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: zephyr
  service: zbus_proxy_agent_ipc
detection:
  selection_msg:
    - 'zbus_proxy_agent_ipc.c'
    - 'zbus proxy agent'
  selection_reject:
    - 'rejected'
    - 'invalid channel name'
    - 'invalid message_size'
  selection_anomaly:
    - '\\x00'
    - '(non-printable)'
  condition: selection_msg and selection_reject
  condition_anomaly: selection_msg and selection_reject and selection_anomaly
falsepositives:
  - Legitimate firmware bugs sending malformed frames during development
  - Fuzzing and bring-up test harnesses
level: medium
tags:
  - attack.t1005
  - cve.2026.18418

YARA Rule

rule CVE_2026_18418_Zephyr_Zbus_Proxy_Agent_IPC_Unterminated_Log
{
    meta:
        description = "Detects the unsafe %s logging of the fixed-size channel_name[] array in the Zephyr zbus proxy agent IPC backend (CVE-2026-18418)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18418"
        date = "2026-01-01"
        cve = "CVE-2026-18418"
        severity = "low"

    strings:
        $file = "zbus_proxy_agent_ipc.c" ascii
        $msg  = "struct zbus_proxy_msg" ascii
        $name = "channel_name" ascii
        $cb   = "zbus_proxy_agent_receive_cb" ascii
        $fmt  = "%s" ascii

    condition:
        uint16(0) == 0x5A5A or
        (
            ( $file or $cb ) and
            $msg and
            $name and
            $fmt
        )
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-18418 Zephyr zbus Proxy Agent IPC Malformed Inter-Domain Frame (possible unterminated channel_name / invalid message_size)"; flow:to_server; dsize:>=64; content:"|00 00 00 00|"; depth:4; classtype:attempted-recon; reference:cve,2026-18418; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-18418; sid:202618418; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Note: This rule targets inter‑domain IPC traffic captured locally; it is a best‑effort heuristic since the frame format is not publicly documented. Tune dsize, depth, and content offsets to your instrumented transport.

Elastic Detection

sequence by host.id with maxspan=5s
  [ process where event.action == "start" and process.name != null ]
  [ log where
      log.level == "warning" and
      ( log.message : "zbus_proxy_agent_ipc.c" or log.message : "zbus proxy agent" ) and
      ( log.message : "rejected" or log.message : "invalid channel name" or log.message : "invalid message_size" )
  ]

Analysts should alert when repeated zbus proxy agent rejection warnings originate from a nonzero/peer IPC domain within a short window, which may indicate a peer domain attempt to trigger the out‑of‑bounds read.

Splunk SPL Query

index=embedded OR index=zephyr sourcetype=zephyr_log
| eval msg=coalesce(log_message, _raw)
| where match(msg, "(?i)zbus_proxy_agent_ipc\.c")
| where match(msg, "(?i)(rejected|invalid channel name|invalid message_size)")
| eval peer_domain=coalesce(peer_domain, ipc_domain, "unknown")
| stats count as reject_events, values(msg) as sample_msgs by host, peer_domain, _time
| where reject_events >= 3
| sort - reject_events

Repeated rejection warnings clustered per peer domain within a short window are the primary indicator; unusually long rendered channel_name values or non‑printable bytes in the log payload are strong corroboration.

Wazuh OSSEC Rule

<group name="zephyr,cve-2026-18418,">
  <rule id="184180" level="6">
    <decoded_as>zephyr-log</decoded_as>
    <match>zbus_proxy_agent_ipc.c</match>
    <description>CVE-2026-18418: Zephyr zbus proxy agent IPC backend log entry (possible unterminated channel_name handling)</description>
  </rule>

  <rule id="184181" level="10" frequency="3" timeframe="60">
    <if_matched_sid>184180</if_matched_sid>
    <match>rejected|invalid channel name|invalid message_size</match>
    <same_source_ip />
    <description>CVE-2026-18418: Repeated zbus proxy agent IPC rejections from peer domain - possible malicious malformed frame injection</description>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix or workaround is currently published for CVE-2026-18418.

1) Immediate mitigations (compensating controls):

• Disable the zbus proxy agent IPC backend where it is not operationally required: build with CONFIG_ZBUS_PROXY_AGENT_IPC disabled. This removes the vulnerable code path entirely and is the single most effective mitigation.
• Where the backend must remain enabled, raise certainty of termination at the source by constraining channel_name[] producers to always NUL‑terminate and validating message_size before any logging occurs. Ensure the length passed to the logging subsystem is bounded by the fixed array size (e.g., pass an explicit length or a bounded conversion) rather than relying on %s.
• Reduce logging level below warning only as a temporary, partial measure — the NVD description notes the sink requires logging built at warning level or above, so lowering the threshold removes reachability. Weigh this against loss of detection visibility.
• Treat the peer domain as a trust boundary: enforce firmware image signing/verification and secure boot for all cores on the SoC so an attacker cannot gain the "control over the firmware of the peer domain" precondition (PR:H). This directly raises the bar for exploitation.
• Monitor for repeated zbus proxy agent IPC rejection warnings and for log lines containing non‑printable or abnormally long channel‑name content.

2) Patch / upgrade steps:

• No fixed version is available. Monitor the upstream Zephyr project's commit history and security advisories for a change to subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c that replaces the %s conversion with a length‑bounded conversion or guarantees NUL termination before logging.
• When a fix is released, update to the patched revision and rebuild affected firmware; validate that the rejection logging path no longer performs an unbounded strlen() on channel_name[].
• Track the NVD entry (below) and the upstream project advisory channel for the fix reference; this report will require revision once a patch identifier exists.

3) Long‑term hardening:

• Adopt a policy of never using unbounded %s on fixed‑size IPC/frame fields; the logging packager should use explicit length arguments or bounded conversions for all structured binary fields.
• Extend the receive callback validation so that NUL termination is verified at the transport boundary (zbus_proxy_agent_receive_cb()) and any logging of untrusted fields occurs only after that verification.
• Add fuzzing of inter‑domain IPC parsers against frames of exactly sizeof(struct zbus_proxy_msg) bytes with no NUL in channel_name[] and with out‑of‑range message_size, using the icmsg and rpmsg backends, and integrate these into CI.
• Apply defense‑in‑depth for multi‑core SoCs: memory protection/MPU isolation between domains, stack initialization to reduce the forensic value of leaked stack bytes, and strict peer‑firmware authentication.

References

1. NIST NVD — CVE-2026-18418: https://nvd.nist.gov/vuln/detail/CVE-2026-18418
2. MITRE CWE — CWE-125: Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
3. FIRST — CVSS v3.1 Specification Document (vector interpretation): https://www.first.org/cvss/specification-document
4. Zephyr Project — zbus and IPC documentation (zbus proxy agent; icmsg and rpmsg backends): https://docs.zephyrproject.org/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-18418 not listed; KEV status: NO): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns: none known. No exploit‑in‑the‑wild evidence, no public proof‑of‑concept, no Nuclei template, and no CISA KEV listing as of this report. FIRST.org has not assigned an EPSS score.