The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_…

CVE-2026-10848 is a vulnerability in the Zephyr RTOS OCPP 1.6 client implementation affecting the parse_rpc_msg() function in subsys/net/lib/ocpp/ocpp_j.c. The flaw stems from the hand-rolled extract_string_field() helper using strncpy() without guaranteeing NUL-termination, followed by an unbounded strchr() scan that can read past a 128-byte stack buffer. A related defect in extract_payload() similarly operates on potentially non-NUL-terminated receive buffers. A malicious or compromised OCPP central server, or an on-path attacker exploiting the commonly used unencrypted ws:// transport, can send a crafted RPC frame with a 127+ byte uid or action field to trigger the out-of-bounds access. The primary impact is a remotely triggerable denial of service via stack fault or corruption; data disclosure is limited as over-read bytes are not reflected. The feature is experimental and must be explicitly enabled via CONFIG_OCPP. The fix replaces the manual parser with the bounds-respecting json_mixed_arr_parse() and enforces explicit NUL-termination on extracted fields.