{"metadata": {"vulnerability": "CVE-2026-18418", "count": 10, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-07-30T17:54:15.055Z", "date_only": false, "value": "2026-07-30T17:54:15.055Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-18418", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-11T17:15:00.221Z", "date_only": false, "value": "2026-10-11T17:15:00.221Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-18418", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-11T17:15:00.221Z", "date_only": false, "value": "2026-10-11T17:15:00.221Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / zephyr", "record": "CVE-2026-18418", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-11T17:22:08.114Z", "date_only": false, "value": "2026-10-11T17:22:08.114034Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117423428575947198", "record": "CVE-2026-18418", "field": "creation_timestamp", "uuid": "96369bd4-96b9-4ca8-aac1-09c97ec6d3e3", "content": "CVE-2026-18418 Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport guarantees the array is NUL-terminated. The only code that verifies termination is zbus_proxy_agent_receive_cb() in subsys/zbus/proxy_agent/zbus_proxy_agent.c, which rejects the frame in precisely those cases \u2014 so the warning printed a non-terminated buffer exactly on the error paths where the name had been found invalid (or, for an invalid message_size, had not been inspected at all).\nAny peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it, by sending a frame with an out-of-range message_size or with channel_name[] containing no NUL byte. Reaching the code requires CONFIG_ZBUS_PROXY_AGENT_IPC and logging built at warning level or above (the default), and requires control over the firmware of the peer domain \u2014 typically a second core on the same SoC.\nThe resulting strlen() inside the log packager walks past the end of the frame object until it finds a zero byte. With the icmsg backend the frame lives in a stack buffer of the IPC work-queue thread, so bytes of that thread's stack are rendered into the log message; with the rpmsg backends the scan continues through the shared vring memory. Impact is bounded to disclosure of a small amount of adjacent memory into the receiving domain's log sink, plus a possible fatal fault if the scan leaves a mapped region; the log packager's own -ENOSPC bound prevents the overrun from becoming a write. The fix bounds the conversion with %.*s and MIN(msg->channel_name_len, sizeof(msg->channel_name)).\nhttps://www.cve.org/CVERecord?id=CVE-2026-18418https://github.com/zephyrproject-rtos/zephyr/commit/fc065f79a568a6c6cc14b89795bd60e5eabd6f02https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-48w8-fjhj-r9w8#zephyrproject #zephyr#CVE_2026_18418#bot", "url": "https://infosec.exchange/users/cve/statuses/117423428575947198"}, {"timestamp": "2026-10-11T18:16:58.113Z", "date_only": false, "value": "2026-10-11T18:16:58.113", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-18418", "record": "FKIE_CVE-2026-18418", "field": "published"}, {"timestamp": "2026-10-15T17:51:25.324Z", "date_only": false, "value": "2026-10-15T17:51:25.324466Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-18418", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T17:51:25.324Z", "date_only": false, "value": "2026-10-15T17:51:25.324466Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-18418", "record": "FKIE_CVE-2026-18418", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T18:09:08.898Z", "date_only": false, "value": "2026-10-15T18:09:08.898Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-18418", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T18:09:08.898Z", "date_only": false, "value": "2026-10-15T18:09:08.898Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-18418", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T19:17:36.960Z", "date_only": false, "value": "2026-10-15T19:17:36.960", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-18418", "record": "FKIE_CVE-2026-18418", "field": "lastModified"}]}