Is CVE-2026-19184 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19184 being exploited in the wild.

How severe is CVE-2026-19184?

High severity, with a CVSS score of 8.4, published 5 October 2026.

Which products and versions are affected?

Zephyr RTOS Prior to fix (NXP RW61x with GAU ADC and CONFIG_USERSPACE enabled).

How is CVE-2026-19184 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-19184?

Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19184: NXP GAU ADC driver buffer overflow in adc_mcux_gau_adc

CVE-2026-19184 · Severity: high · CVSS 8.4 · Published 2026-10-05

The Zephyr operating system's NXP GAU ADC driver contains a buffer overflow vulnerability in its ADC data reading functionality. A user-mode application with access to an ADC device can supply a deliberately undersized buffer, causing the driver to write ADC conversion results beyond the buffer's boundaries. On systems with user-space protection enabled, this allows unprivileged code to corrupt kernel memory, crash the system, or escalate privileges.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-19184 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19184 being exploited in the wild.
How severe is CVE-2026-19184?: High severity, with a CVSS score of 8.4, published 5 October 2026.
Which products and versions are affected?: Zephyr RTOS Prior to fix (NXP RW61x with GAU ADC and CONFIG_USERSPACE enabled).
Is there a fix for CVE-2026-19184?: Yes: fixed in The fix replaces the validation with adc_sequence_validate_buffer() helper and corrects buffer size calculations in drivers/adc/adc_mcux_gau_adc.c (specific version not stated in advisory).. Until then: Disable CONFIG_USERSPACE if user-space isolation is not required, or restrict ADC device access to trusted applications only; builds without CONFIG_USERSPACE are not exposed to privilege escalation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19184 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-19184?: Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: The fix replaces the validation with adc_sequence_validate_buffer() helper and corrects buffer size calculations in drivers/adc/adc_mcux_gau_adc.c (specific version not stated in advisory).

Disable CONFIG_USERSPACE if user-space isolation is not required, or restrict ADC device access to trusted applications only; builds without CONFIG_USERSPACE are not exposed to privilege escalation.

Technical details

The driver incorrectly validates buffer_size (in bytes) against the number of ADC channels without accounting for the fact that each conversion result occupies 2 bytes (uint16_t). This causes the driver to write up to twice the supplied buffer size. The vulnerability is exploitable via the adc_read() and adc_read_async() Zephyr system calls on NXP RW61x SoCs with CONFIG_USERSPACE enabled, allowing a user-mode thread to trigger an out-of-bounds write in supervisor-mode code with attacker-controlled destination and length.

Affected products

Zephyr Zephyr RTOS Prior to fix (NXP RW61x with GAU ADC and CONFIG_USERSPACE enabled)

Timeline

2026-10-05: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.