CVE-2026-18746 | CVSS: 5.9 | 严重级别: MEDIUM
parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called init_block_ctx() and then immediately stored the peer-selected block size with block_ctx->ctx.block_size = block_size before inspecting the return code. init_block_ctx() sets the caller's pointer to NULL and returns -ENOMEM when no entry of the static block1_contexts[] pool is free or timed out, so that store dereferences a NULL pointer.
The pool holds CONFIG_LWM2M_NUM_BLOCK1_CONTEXT entries (default 3) and an entr
参考链接:
• https://github.com/zephyrproject-rtos/zephyr/commit/e61790f776863032925e96819f84
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4q9g-2mhh-
📌 数据来源: NVD 官方