# CVE-2026-19184: NXP GAU ADC driver buffer overflow in adc_mcux_gau_adc

Source: https://junglewise.ai/threats/cve-2026-19184-the-nxp-gau-adc-driver-drivers-adc-adc-mcux-gau-adc-c-validated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-19184 · Severity: high · CVSS 8.4 · Published 2026-10-05

The Zephyr operating system's NXP GAU ADC driver contains a buffer overflow vulnerability in its ADC data reading functionality. A user-mode application with access to an ADC device can supply a deliberately undersized buffer, causing the driver to write ADC conversion results beyond the buffer's boundaries. On systems with user-space protection enabled, this allows unprivileged code to corrupt kernel memory, crash the system, or escalate privileges.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19184 being exploited in the wild.

**How severe is CVE-2026-19184?** High severity, with a CVSS score of 8.4, published 5 October 2026.

**Which products and versions are affected?** Zephyr RTOS Prior to fix (NXP RW61x with GAU ADC and CONFIG_USERSPACE enabled).

**Is there a fix for CVE-2026-19184?** Yes: fixed in The fix replaces the validation with adc_sequence_validate_buffer() helper and corrects buffer size calculations in drivers/adc/adc_mcux_gau_adc.c (specific version not stated in advisory).. Until then: Disable CONFIG_USERSPACE if user-space isolation is not required, or restrict ADC device access to trusted applications only; builds without CONFIG_USERSPACE are not exposed to privilege escalation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19184 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-19184?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in The fix replaces the validation with adc_sequence_validate_buffer() helper and corrects buffer size calculations in drivers/adc/adc_mcux_gau_adc.c (specific version not stated in advisory).

Disable CONFIG_USERSPACE if user-space isolation is not required, or restrict ADC device access to trusted applications only; builds without CONFIG_USERSPACE are not exposed to privilege escalation.

## Technical details

The driver incorrectly validates buffer_size (in bytes) against the number of ADC channels without accounting for the fact that each conversion result occupies 2 bytes (uint16_t). This causes the driver to write up to twice the supplied buffer size. The vulnerability is exploitable via the adc_read() and adc_read_async() Zephyr system calls on NXP RW61x SoCs with CONFIG_USERSPACE enabled, allowing a user-mode thread to trigger an out-of-bounds write in supervisor-mode code with attacker-controlled destination and length.

## Affected products

- Zephyr Zephyr RTOS Prior to fix (NXP RW61x with GAU ADC and CONFIG_USERSPACE enabled)

## Timeline

- 2026-10-05: disclosed

## Related threats

- [Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys)
- [Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread)
- [Zephyr HTTP/2 server NULL pointer dereference in stream binding](https://junglewise.ai/threats/cve-2026-87045-the-http-2-server-in-subsys-net-lib-http-http-server-http2-c)
- [Zephyr RTIO submission-queue verifier memory access bypass](https://junglewise.ai/threats/cve-2026-87041-the-rtio-submission-queue-verifier-rtio-vrfy-sqe-in-subsys-rtio)
- [Zephyr i3c_transfer TOCTOU privilege escalation](https://junglewise.ai/threats/cve-2026-87038-the-user-mode-verification-handler-for-the-i3c-transfer-system)