CVE-2026-10666 – Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

CVE ID :CVE-2026-10666

Published : July 12, 2026, 4:16 p.m. | 1 hour, 11 minutes ago

Description :parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form “a.b.c.d:port”) copies the port substring into a fixed 17-byte stack buffer (char ipaddr[NET_IPV4_ADDR_LEN + 1]) using a length of str_len – end – 1, where str_len is the full, unbounded input length and end is only the (
Severity: 8.1 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…