CVE-2026-8718

What it is

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_SSL_CID_OUT_LEN_MAX) into that buffer without a destination-size parameter, so a caller-supplied optlen smaller than the CID causes a write of up to 31 bytes past the buffer end. In CONFIG_USERSPACE builds the getsockopt syscall verifier (z_vrfy_zsock_getsockopt) bounce-buffers the user's optval into a kernel allocation of exactly optlen bytes (k_usermode_alloc_from_copy -> z_thread_malloc), so an unprivileged user thread that passes a small optlen on a connected DTLS socket with Connection ID enabled induces a kernel-heap buffer overflow, with the overflowing content being the remote peer's CID. The defect requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, an established DTLS session with a negotiated peer CID, and (for the kernel-crossing case) CONFIG_USERSPACE. Introduced when the TLS_DTLS_CID option was added (v3.5.0). The fix rejects callers whose optlen is below MBEDTLS_SSL_CID_OUT_LEN_MAX with -EINVAL.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account. High risk of data tampering, service disruption.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-10 23:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-11-04 05:19 UTC Last updatedMost recent change to the record

Details

Published

2026-08-10 23:16 UTC

Last modified

2026-11-04 05:19 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-787 · Out-of-bounds write

Record status

Awaiting Analysis

Attack profile CVSS 3.1 · 8.4

Attack vector

Local

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High