# CVE-2026-19676: Zephyr RTOS PECI driver privilege escalation in peci_transfer()

Source: https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-19676 · Severity: high · CVSS 7.8 · Published 2026-10-21

Zephyr RTOS's PECI (Platform Environment Control Interface) driver failed to properly validate memory buffers passed from user-mode applications, allowing local code execution to read and write kernel memory. An attacker with access to a PECI device could escalate privileges to kernel mode, execute arbitrary code, or crash the system.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19676 being exploited in the wild.

**How severe is CVE-2026-19676?** High severity, with a CVSS score of 7.8, published 21 October 2026.

**Which products and versions are affected?** Zephyr RTOS versions prior to fix.

**Is there a fix for CVE-2026-19676?** No fixed version is recorded yet. Disable or restrict access to PECI device objects in CONFIG_USERSPACE configurations where the drivers CONFIG_PECI_NPCX, CONFIG_PECI_XEC, or CONFIG_PECI_ITE_IT8XXX2 are enabled until a patched version is deployed.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19676 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-19676?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable or restrict access to PECI device objects in CONFIG_USERSPACE configurations where the drivers CONFIG_PECI_NPCX, CONFIG_PECI_XEC, or CONFIG_PECI_ITE_IT8XXX2 are enabled until a patched version is deployed.</anigation>
</invoke>

## Technical details

The z_vrfy_peci_transfer() verifier in drivers/peci/peci_handlers.c only validated the outer structure of the peci_msg but left embedded buffer pointers (tx_buffer.buf, rx_buffer.buf) and their lengths under caller control. All in-tree PECI drivers (peci_npcx, peci_mchp_xec, peci_ite_it8xxx2) dereference these unchecked pointers in supervisor mode, enabling arbitrary kernel reads and writes. Exploitation requires CONFIG_USERSPACE=y, a PECI driver enabled, and local code execution in a user-mode thread holding the PECI device object.

## Affected products

- Zephyr RTOS versions prior to fix

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack)
- [Zephyr Bluetooth host ATT buffer use-after-free in signed write path](https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does)
- [Zephyr Bluetooth Mesh Access layer delayable message context leak](https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in)
- [Zephyr TCP ISN derivation with all-zero key on entropy failure](https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net)
- [Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption](https://junglewise.ai/threats/cve-2026-19186-ieee802154-decipher-data-frame-in-subsys-net-l2-ieee802154)