Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U H H H 7.8 .0017 6.5 —
AFFECTED Product Versions Fixed Zephyr unspecified —
TIMELINE Mar 27 Reserved by zephyr May 30 EXPLOIT PUBLISHED — CVE-2026-5071 (zephyrproject-rtos Zephyr). Public exploit reference added. May 30 Published (CNA: zephyr)
The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.
| Date | Event | Detail |
|---|---|---|
| March 27, 2026 | Reserved | Reserved by zephyr |
| May 30, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-5071 (zephyrproject-rtos Zephyr). Public exploit reference added. |
| May 30, 2026 | Published | Published (CNA: zephyr) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| zephyrproject-rtos | Zephyr | — | — | — |
Authoritative record: CVE-2026-5071 at cve.org
Vendors: zephyrproject-rtos
Weaknesses: CWE-125
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-5071 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.