CVE WATCH / VULNERABILITY DETAIL
CVE-2026-76787
MEDIUMCVSS 5.9NVD feed
Published 19 October 2026 · tracked since 20 October 2026
Description
The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe() (subsys/mgmt/updatehub/updatehub.c). The decoder treats every descriptor field as optional — json_obj_parse() returns a bitmask of the fields it actually decoded and never
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog