What is CVE-2026-12232?

CVE-2026-12232 is a medium-severity vulnerability in Zephyrproject Zephyr, classified under Out-of-bounds Read. CVSS score: 6.1/10. Published 2026-08-12.

How severe is CVE-2026-12232?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Out-of-bounds Read in Zephyrproject Zephyr

CVE-2026-12232

The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The value indexes the fixed-size static const uint8_t alh_handshak…

Vulnerability class: Buffer Overflow

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L.

Affected products

Zephyrproject Zephyr — versions 4.4.0

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

vulnerabilities@zephyrproject.org (patch)
vulnerabilities@zephyrproject.org

Frequently asked questions

What is CVE-2026-12232?: CVE-2026-12232 is a medium-severity vulnerability in Zephyrproject Zephyr, classified under Out-of-bounds Read. CVSS score: 6.1/10. Published 2026-08-12.
How severe is CVE-2026-12232?: Medium severity. CVSS v3 base score is 6.1 out of 10.