What is CVE-2026-12633?
CVE-2026-12633 is a vulnerability in the IPv6 neighbor discovery code of Zephyr RTOS where the 6LoWPAN Context Option (6CO) is processed. The `handle_ra_6co()` function fails to validate the 8-bit `context_len` field against the RFC 6775 maximum of 128, potentially leading to a buffer overflow. Users should patch affected devices with the latest security updates.
Azərbaycanca: CVE-2026-12633 Zephyr RTOS-da IPv6 qonşu kəşfi (neighbor discovery) kodunda 6LoWPAN Context Option emalı ilə bağlı zəiflikdir. `handle_ra_6co()` funksiyasında paketdən gələn 8-bitlik `context_len` sahəsi RFC 6775 ilə müəyyən edilmiş 128 maksimum həddi ilə yoxlanılmır. Bu, yaddaş pozuntusuna (buffer overflow) səbəb ola bilər, istifadəçilərə cihazları ən son təhlükəsizlik yeniləmələri ilə patç etmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-119
FAQ2
In which component of Zephyr RTOS was CVE-2026-12633 discovered?
CVE-2026-12633 was discovered in the IPv6 neighbor discovery code of Zephyr RTOS, related to the processing of the 6LoWPAN Context Option.
What is the root cause of the CVE-2026-12633 vulnerability?
The root cause is that the `handle_ra_6co()` function does not validate the 8-bit `context_len` field from the packet against the maximum limit of 128 defined by RFC 6775.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.