NULL-pointer and out-of-bounds write in Zephyr MCTP I2C+GPIO target binding (CVE-2026-10678)

The MCTP-over-I2C+GPIO target binding in Zephyr fails to validate receive buffer allocation and bounds before writing in mctp_i2c_gpio_target_write_received(). An unauthenticated I2C bus controller can trigger a NULL-pointer dereference write or a one-byte heap overflow by sending data bytes out of order or in excess of 255 bytes, leading to memory corruption or denial of service on the target device. Affected versions: - >= 4.3.0, < 4.5.0 We recommend updating to: 4.5.0. CVSS 8.1 · our assessment: this_week Reference: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pmwm-5rcm-39rr Details: https://vuln.today/cve/CVE-2026-10678