CVE-2026-10848 is a high severity memory safety flaw (CVSS 7.0) in the Zephyr OCPP 1.6 client, which handles messages from an electric vehicle charging central system. A long field can cause an out-of-bounds read and a one byte write. Zephyr 4.4.2 is the patched release.
What's affected
The record does not give versions. The GitHub advisory GHSA-jgqq-7mjj-w642, published on 2 August 2026 and rated High, lists Zephyr as affected from 4.3.0 up to but not including 4.4.2, with a patched version of 4.4.2. It also calls the OCPP implementation experimental.
The record scores the issue at 7.0, with a network vector, high attack complexity, no privileges, and low confidentiality and integrity impact with high availability impact. The weaknesses are CWE-125, out-of-bounds read, and CWE-787, out-of-bounds write.
The advisory says the data comes from the OCPP central system over a websocket. The attacker is therefore a malicious or compromised central system, or someone positioned to alter that traffic. For a charger that talks only to your own backend over a well configured connection, the practical risk is lower than for one that connects to a third party system.
How to check if you're exposed
Check whether your firmware uses the OCPP subsystem at all. In your build directory:
grep -i ocpp build/zephyr/.config
If the OCPP options are not enabled, the code is not in your image. Then check the Zephyr version your project builds against:
git -C $ZEPHYR_BASE describe --tags
Versions from 4.3.0 up to below 4.4.2 are in the advisory range. If you track a vendor fork of Zephyr, ask the vendor which upstream fixes are included, since embedded vendors often lag.
What to do now
- Update Zephyr to 4.4.2 or later and rebuild the firmware.
- If you use a vendor SDK, ask the vendor for a build that includes the fix and a date for it.
- Plan the over the air update path for devices in the field, since a charger often needs a staged rollout.
- Use TLS to a central system you control and verify its certificate, to reduce exposure to a tampered connection.
- Monitor devices for unexpected restarts, which can be a sign of memory faults.
Why it matters
The parser copies a field from an incoming message into a fixed buffer of 128 bytes using a function that does not add a terminating zero when the source is long. It then scans the result for a quote character, and with no terminator the scan runs past the end into neighbouring stack memory. If a quote is found there, a zero byte is written, which is a one byte out-of-bounds write.
The advisory adds a second problem: the same unterminated string is later used to build the reply, so memory contents could be sent back to the server. That turns a read past the buffer into a possible leak that is visible on the network.
Embedded code makes this worse. There is often no memory protection to stop a stray write and no easy way to patch the device. Safe string handling at the boundary where network data enters is the fix. The record does not mark the CVE as known exploited.
Quick check
Is OCPP support on by default in Zephyr?
The advisory calls the OCPP implementation experimental. Check your build configuration to see if it is enabled in your image.
Who can trigger the flaw?
The advisory says a malicious or compromised central system, which controls the websocket messages.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
