Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:HSummary
CVE-2026-1681 is a medium-severity Uncontrolled Recursion (CWE-674) vulnerability in Zephyrproject Zephyr. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-7 (Boundary Protection) and SI-16 (Memory Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29387
Vulnerability Data
Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the destination is recognized as a local…
more
address, both the echo request and the resulting echo reply are processed inline before the current frame returns. The nested input-path frames exceed the work-queue stack and trigger a stack overflow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow triggered via local shell command enables Endpoint DoS via system exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Boundary protection at the network layer can drop or rate-limit ICMP echo requests addressed to the device itself, preventing the recursive input-path re-entry that leads to stack overflow.
Memory protection mechanisms can enforce stack canaries or guard pages that detect and terminate the excessive recursion before the work-queue stack overflows.
Prompt application of the vendor patch that fixes the recursive handling of locally-addressed ICMP packets eliminates the root cause of the stack overflow.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding errors such as missing recursion limits or termination conditions.
Runtime monitoring of compute resources can detect excessive consumption caused by uncontrolled recursion.
Vulnerability identification processes can discover and record uncontrolled recursion flaws before deployment.
Capacity monitoring and resource provisioning can absorb or limit the impact of runaway recursion.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect excessive recursion via static analysis or fuzzing.
Secure development life cycle requires controls that prevent uncontrolled recursion through design and code review.
Application security requirements can mandate recursion limits or stack-depth checks.
Secure system architecture principles include resource-management and input-validation rules that limit recursion.
Secure coding standards directly prohibit or constrain recursive constructs that could exhaust stack or memory.
Change management can enforce review gates that catch unsafe memory operations before deployment.