Is CVE-2026-19676 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19676 being exploited in the wild.

How severe is CVE-2026-19676?

High severity, with a CVSS score of 7.8, published 21 October 2026.

Which products and versions are affected?

Zephyr RTOS versions prior to fix.

How is CVE-2026-19676 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-19676?

Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19676: Zephyr RTOS PECI driver privilege escalation in peci_transfer()

CVE-2026-19676 · Severity: high · CVSS 7.8 · Published 2026-10-21

Zephyr RTOS's PECI (Platform Environment Control Interface) driver failed to properly validate memory buffers passed from user-mode applications, allowing local code execution to read and write kernel memory. An attacker with access to a PECI device could escalate privileges to kernel mode, execute arbitrary code, or crash the system.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-19676 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19676 being exploited in the wild.
How severe is CVE-2026-19676?: High severity, with a CVSS score of 7.8, published 21 October 2026.
Which products and versions are affected?: Zephyr RTOS versions prior to fix.
Is there a fix for CVE-2026-19676?: No fixed version is recorded yet. Disable or restrict access to PECI device objects in CONFIG_USERSPACE configurations where the drivers CONFIG_PECI_NPCX, CONFIG_PECI_XEC, or CONFIG_PECI_ITE_IT8XXX2 are enabled until a patched version is deployed.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19676 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-19676?: Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable or restrict access to PECI device objects in CONFIG_USERSPACE configurations where the drivers CONFIG_PECI_NPCX, CONFIG_PECI_XEC, or CONFIG_PECI_ITE_IT8XXX2 are enabled until a patched version is deployed.</anigation> </invoke>

Technical details

The z_vrfy_peci_transfer() verifier in drivers/peci/peci_handlers.c only validated the outer structure of the peci_msg but left embedded buffer pointers (tx_buffer.buf, rx_buffer.buf) and their lengths under caller control. All in-tree PECI drivers (peci_npcx, peci_mchp_xec, peci_ite_it8xxx2) dereference these unchecked pointers in supervisor mode, enabling arbitrary kernel reads and writes. Exploitation requires CONFIG_USERSPACE=y, a PECI driver enabled, and local code execution in a user-mode thread holding the PECI device object.

Affected products

Zephyr RTOS versions prior to fix

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.