# CVE-2026-19185: Zephyr RTOS i3c_do_ccc() memory validation bypass

Source: https://junglewise.ai/threats/cve-2026-19185-the-system-call-verifier-for-i3c-do-ccc-in-drivers-i3c-i3c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-19185 · Severity: high · CVSS 7.8 · Published 2026-10-05

Zephyr RTOS's I3C controller interface fails to validate memory buffers passed from user-mode applications, allowing unprivileged threads to read and write arbitrary kernel memory. An attacker with I3C device access can trigger kernel drivers to leak sensitive data or corrupt kernel state, bypassing the security isolation that CONFIG_USERSPACE is meant to provide.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19185 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19185 being exploited in the wild.

**How severe is CVE-2026-19185?** High severity, with a CVSS score of 7.8, published 5 October 2026.

**Which products and versions are affected?** Zephyr RTOS Versions with CONFIG_USERSPACE builds including drivers/i3c/i3c_handlers.c.

**Is there a fix for CVE-2026-19185?** Yes: fixed in <UNKNOWN>. Until then: Disable CONFIG_USERSPACE if I3C controller access is not required for unprivileged applications, or restrict I3C device object access to trusted user-mode threads only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19185 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-19185?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

Disable CONFIG_USERSPACE if I3C controller access is not required for unprivileged applications, or restrict I3C device object access to trusted user-mode threads only.

## Technical details

The i3c_do_ccc() system call verifier validates the outer i3c_ccc_payload struct and the targets array itself, but does not validate per-target data buffers pointed to by array elements, nor does it snapshot the payload structure before use. Unprivileged user-mode code with I3C device access can supply arbitrary kernel addresses as per-target buffer pointers; kernel drivers then dereference these directly for I3C read (writing to attacker-chosen address) or write (leaking kernel memory) operations. The vulnerability allows privilege escalation and memory disclosure by exploiting a time-of-check-time-of-use (TOCTTOU) race and missing boundary validation in CONFIG_USERSPACE builds.

## Affected products

- Zephyr RTOS Versions with CONFIG_USERSPACE builds including drivers/i3c/i3c_handlers.c

## Timeline

- 2026-10-05: disclosed

## Related threats

- [Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack)
- [Zephyr RTOS PECI driver privilege escalation in peci_transfer()](https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy)
- [Zephyr Bluetooth host ATT buffer use-after-free in signed write path](https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does)
- [Zephyr Bluetooth Mesh Access layer delayable message context leak](https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in)
- [Zephyr TCP ISN derivation with all-zero key on entropy failure](https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net)