# CVE-2026-10645: Zephyr OS out-of-bounds read in ext2 directory-entry parser

Source: https://junglewise.ai/threats/cve-2026-10645-zephyr-os-out-of-bounds-read-in-ext2-directory-entry-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-10645 · Severity: medium · CVSS 4.9 · Published 2026-06-23

Zephyr is an open-source operating system designed for resource-constrained IoT devices. A vulnerability in its ext2 filesystem driver allows a specially crafted storage device (like a malicious SD card or USB drive) to crash the system or leak sensitive memory information. This occurs when the system attempts to read or list files on the untrusted media, potentially leading to a permanent device freeze or data exposure.

Technologies: [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-10645 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10645 being exploited in the wild.

**How severe is CVE-2026-10645?** Medium severity, with a CVSS score of 4.9, published 23 June 2026.

**Which products and versions are affected?** Zephyr Project Zephyr OS <= 4.4.

**Is there a fix for CVE-2026-10645?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10645 attacked?** It is attacked with physical access, in an operating system.

**Am I affected by CVE-2026-10645?** Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read and infinite loop vulnerability exists in Zephyr's ext2 filesystem implementation within `subsys/fs/ext2/ext2_diskops.c`. The `ext2_fetch_direntry()` function fails to validate the structural relationship between the record length (`de_rec_len`), name length (`de_name_len`), and the directory block boundary. Specifically, it lacks checks to ensure `de_rec_len` is non-zero and that the entry fits within the block before performing a `memcpy` or advancing the traversal offset. An attacker with physical access can provide a crafted ext2 image that triggers an OOB read past the block buffer or a zero-progress infinite loop during directory traversal operations such as `ls`, `stat`, or `open`. Patches have been merged into the main branch and several stable branches (v4.4, v4.3).

## Affected products

- Zephyr Project Zephyr OS <= 4.4

## Timeline

- 2026-03-22: other: Vulnerability confirmed present in Zephyr main commit 56f8a30c
- 2026-06-21: other: Embargo date
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date

## References

- [https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hwrh-9h3x-vccm](https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hwrh-9h3x-vccm)

## Related threats

- [Zephyr MCTP over USB use-after-free in packet buffer handling](https://junglewise.ai/threats/cve-2026-85032-the-mctp-over-usb-device-class-in-subsys-pmci-mctp-mctp-usb-c)
- [Zephyr arm64 MMU TLB invalidation memory isolation bypass](https://junglewise.ai/threats/cve-2026-79979-the-arm64-mmu-backend-invalidates-a-single-virtual-address-from)
- [Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsing](https://junglewise.ai/threats/cve-2026-76787-the-updatehub-firmware-over-the-air-client-parses-the-coap-probe)
- [CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsing](https://junglewise.ai/threats/cve-2026-75084-the-cc1200-sub-ghz-ieee-802-15-4-driver-takes-the-phy-packet)
- [Zephyr Bluetooth Link Layer memory leak in connection update](https://junglewise.ai/threats/cve-2026-19739-the-bluetooth-link-layer-control-procedure-code-in-subsys)