Is CVE-2026-10645 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10645 being exploited in the wild.

How severe is CVE-2026-10645?

Medium severity, with a CVSS score of 4.9, published 23 June 2026.

Which products and versions are affected?

Zephyr Project Zephyr OS <= 4.4.

Is there a fix for CVE-2026-10645?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10645 attacked?

It is attacked with physical access, in an operating system.

Am I affected by CVE-2026-10645?

Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10645: Zephyr OS out-of-bounds read in ext2 directory-entry parser

Q: Is there a fix for CVE-2026-10645?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-10645 attacked?

It is attacked with physical access, in an operating system.

Q: Am I affected by CVE-2026-10645?

Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10645 · Severity: medium · CVSS 4.9 · Published 2026-06-23

Zephyr is an open-source operating system designed for resource-constrained IoT devices. A vulnerability in its ext2 filesystem driver allows a specially crafted storage device (like a malicious SD card or USB drive) to crash the system or leak sensitive memory information. This occurs when the system attempts to read or list files on the untrusted media, potentially leading to a permanent device freeze or data exposure.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-10645 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10645 being exploited in the wild.
How severe is CVE-2026-10645?: Medium severity, with a CVSS score of 4.9, published 23 June 2026.
Which products and versions are affected?: Zephyr Project Zephyr OS <= 4.4.
Is there a fix for CVE-2026-10645?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10645 attacked?: It is attacked with physical access, in an operating system.
Am I affected by CVE-2026-10645?: Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read and infinite loop vulnerability exists in Zephyr's ext2 filesystem implementation within `subsys/fs/ext2/ext2_diskops.c`. The `ext2_fetch_direntry()` function fails to validate the structural relationship between the record length (`de_rec_len`), name length (`de_name_len`), and the directory block boundary. Specifically, it lacks checks to ensure `de_rec_len` is non-zero and that the entry fits within the block before performing a `memcpy` or advancing the traversal offset. An attacker with physical access can provide a crafted ext2 image that triggers an OOB read past the block buffer or a zero-progress infinite loop during directory traversal operations such as `ls`, `stat`, or `open`. Patches have been merged into the main branch and several stable branches (v4.4, v4.3).

Affected products

Zephyr Project Zephyr OS <= 4.4

Timeline

2026-03-22: other: Vulnerability confirmed present in Zephyr main commit 56f8a30c
2026-06-21: other: Embargo date
2026-06-22: advisory: GitHub Security Advisory published
2026-06-23: disclosed: NVD publication date

References

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hwrh-9h3x-vccm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.