The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_…

CVE-2026-10849 describes a heap-based out-of-bounds write vulnerability in the Zephyr RTOS hawkBit device management client (subsys/mgmt/hawkbit/hawkbit.c). The function response_json_cb() accumulates HTTP response body data into a heap buffer sized exactly to the received bytes, but fails to reserve space for a NUL terminator. When the accumulated body length equals the allocation size, writing the terminator goes one byte past the end of the heap object. In Zephyr v4.0.0 and later, any response body larger than 1100 bytes triggers the flaw deterministically; prior versions are vulnerable when the body length exactly equals the current buffer size. The vulnerability is remotely exploitable by a malicious, compromised, or man-in-the-middle hawkBit update server, with TLS providing no protection against a hostile server. The impact is heap corruption leading to denial of service, with possible further memory corruption depending on the allocator. The fix allocates buffer size as body length plus one and uses memcpy for safe copying.