Executive brief
A vulnerability exists in the Zephyr operating system's communication protocol used for managing hardware components over I2C buses. A malicious or malfunctioning device on the same local hardware bus can send specially crafted messages to trigger memory corruption or a system crash. This could lead to a complete denial of service or unauthorized modification of system memory on the affected device.
Technical details
The MCTP-over-I2C+GPIO target binding in `subsys/pmci/mctp/mctp_i2c_gpio_target.c` fails to validate the order of pseudo-register writes and the status of the receive buffer. Specifically, the `MCTP_I2C_GPIO_RX_MSG_ADDR` handler dereferences `b->rx_pkt` without verifying that a buffer was allocated via a prior length register write. This allows an unauthenticated I2C bus master to trigger a NULL pointer dereference (writing to low memory offsets) or a one-byte heap overflow if more than 255 bytes are sent. The vulnerability is exploitable by any device acting as a bus master on the same I2C bus. Patches have been merged into Zephyr v4.3-branch, v4.4-branch, and main (targeting v4.5.0).
Affected products
- Zephyr Project Zephyr RTOS 4.3.0, 4.4.0
Timeline
- 2025-07-19: other: Vulnerability introduced in commit cbfe781
- 2026-07-21: advisory: GHSA-pmwm-5rcm-39rr published
- 2026-07-21: disclosed: CVE-2026-10678 published