CVE-2026-13214 describes a stack buffer overflow vulnerability in the OCPP 1.6 client implementation within the Zephyr RTOS (subsys/net/lib/ocpp/ocpp_j.c). The vulnerable function parse_getconfig_msg() uses an unbounded strcpy() to copy an attacker-controlled JSON 'key' string into a fixed 50-byte stack buffer, with the key length only bounded by the receive buffer size of up to 2048 bytes. The vulnerability is exploitable by an attacker who controls the central system endpoint or performs a man-in-the-middle attack on an unencrypted WebSocket connection. Exploitation can result in a remotely triggerable stack smash on the OCPP reader thread, leading to at minimum denial of service and potentially remote code execution. The impact depends on build-time hardening measures such as stack canaries and MPU configuration. The fix involves replacing strcpy() with a bounded strncpy() call with explicit NUL termination, consistent with other sibling handler implementations.