Executive brief
Zephyr is an open-source operating system for resource-constrained devices. A flaw in its diagnostic 'coredump' component allows a user with local shell access to trigger an out-of-bounds memory read. This could lead to the exposure of sensitive device memory contents or cause the device to crash, impacting system availability and data confidentiality.
Technical details
An out-of-bounds read exists in 'subsys/debug/coredump/coredump_shell.c' within the 'print_coredump_hdr()' function. The code uses a 16-bit 'tgt_code' field from a stored coredump header as a direct index into the 'coredump_target_code2str[]' array without performing bounds checking. Since the array has only 7 elements, a 'tgt_code' value of 7 or greater results in an out-of-bounds read of a pointer, which is then passed to 'shell_print' as a string. Exploitation requires local shell access and the ability to stage or corrupt a coredump in the flash or memory backend. The vulnerability was fixed by implementing a check that clamps out-of-range codes to an 'unknown' entry.
Affected products
- zephyrproject-rtos zephyr >= 4.2.0, < 4.3.1; >= 4.4.0, <= 4.4.1
Timeline
- 2026-07-28: other: Embargo date
- 2026-07-29: advisory: GHSA-9fw2-4429-49q8 published
- 2026-07-29: disclosed: CVE-2026-10684 published to NVD