CVE-2026-10849 is a high severity heap overflow (CVSS 8.2) in the hawkBit device update client in Zephyr. A response from the update server can make the client write one byte past a heap buffer. Zephyr 4.4.2 is the patched release.
What's affected
The record gives no versions. The GitHub advisory GHSA-39h3-7phx-pwhv, published on 3 August 2026 and rated High, lists Zephyr as affected from 2.4.0 up to but not including 4.4.2, with 4.4.2 as the patched version.
The record scores the flaw at 8.2: network vector, low complexity, no privileges, no interaction, low integrity impact and high availability impact. The weaknesses are CWE-122, heap-based buffer overflow, and CWE-787, out-of-bounds write.
You are exposed if your device firmware includes the hawkBit client, which polls an update server for new firmware. The advisory says the length of the response is chosen by the server, and that it applies to a malicious, compromised or intercepting server. It also notes that TLS is optional in this client and that, even when it is on, it does not protect against a hostile server.
How to check if you're exposed
See whether the hawkBit client is in your image:
grep -i hawkbit build/zephyr/.config
If it is enabled, check your Zephyr version:
git -C $ZEPHYR_BASE describe --tags
Anything from 2.4.0 up to below 4.4.2 is in range. For devices already in the field, read the version from your device management system rather than from the source tree, since the firmware on the device may be older than your current branch.
If you use a vendor distribution, ask which Zephyr release it is based on and whether this fix has been taken.
What to do now
- Update Zephyr to 4.4.2 or later and rebuild firmware that includes the hawkBit client.
- Roll the new firmware out to deployed devices through your normal update channel, in stages.
- Turn on TLS for the update connection and check the server certificate, to cut the chance of a man in the middle.
- Treat your update server as a high value system, since the advisory says a compromised one is the attacker in this model.
- Watch for devices that fault or restart during update checks.
Why it matters
The client collects the body of an HTTP response into a heap buffer sized to the bytes received, with no room for the zero byte that ends a string. When the whole body has arrived, it writes that terminator after the last byte. If the body fills the buffer exactly, the terminator lands one byte beyond the allocation.
According to the advisory, from version 4.0.0 the buffer is sized to the exact body length, so any response larger than the initial buffer triggers the write every time, and normal deployment metadata is that large. Before 4.0.0 the buffer doubled in size, and the bug appeared only when a response matched the buffer size exactly.
One byte sounds small. On a heap, it can damage allocator bookkeeping or the next object, and the advisory expects faults and crashes as the practical result, with other corruption possible. The deeper point is trust. The update channel is the way you fix devices, so a flaw in it is serious. The record does not mark this CVE as known exploited.
Quick check
Can an attacker trigger this without controlling the server?
The advisory describes a malicious, compromised or intercepting update server. It says optional TLS does not protect against a hostile server.
Which versions are affected?
The advisory says 2.4.0 up to but not including 4.4.2.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
