EUVD-2026-39979Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Adjacent vector and AC:H confirmed by serial-line access requirement plus non-default async config and timing dependency; no confidentiality impact from write-only single-byte corruption.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c), used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchronous (DMA) receive path. When uart_rx_enable() is invoked with a one-byte receive buffer (len == 1) and CONFIG_UART_MCHP_ASYNC is enabled, the RX-complete ISR starts a single-beat DMA transfer while a received byte is already pending in the SERCOM DATA register. On this SoC the peripheral-triggered DMA start sequencing then writes one byte past the end of the caller-supplied buffer (CWE-787). The overflowed byte's value is the UART RX data supplied by the connected serial peer (adjacent attacker), while its size and location are fixed at one byte immediately after the buffer. Exploitation requires the async UART config (not enabled by default on the in-tree PIC32CM-JH boards) and a consumer that enables RX with a one-byte buffer; impact is limited single-byte memory corruption adjacent to the RX buffer (possible crash / denial of service). The defect shipped in v4.4.0. The fix reads the first byte with the CPU and, for one-byte buffers, performs no DMA at all; for larger buffers it sizes the DMA for the remaining len-1 bytes.
AnalysisAI
Out-of-bounds write in Zephyr RTOS's Microchip SERCOM-G1 UART driver (introduced in v4.4.0) allows an adjacent attacker who can send serial data to corrupt one byte of memory immediately beyond the caller-supplied RX buffer, potentially causing a crash or denial of service. The flaw exists only when CONFIG_UART_MCHP_ASYNC is enabled (non-default on in-tree PIC32CM-JH board configs) and the consuming application calls uart_rx_enable() with a one-byte buffer - a narrow but real embedded firmware scenario. No exploit code is publicly available and this vulnerability is not listed in CISA KEV; the upstream fix has been committed but a tagged patched release version has not been independently confirmed.
Technical ContextAI
The vulnerability resides in drivers/serial/uart_mchp_sercom_g1.c within the Zephyr RTOS project (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*), targeting PIC32CM-JH SoC family hardware built around Microchip's SERCOM peripheral. The root cause (CWE-787: Out-of-Bounds Write) is a sequencing defect in the async DMA receive path: when uart_rx_enable() is called with len1 and CONFIG_UART_MCHP_ASYNC is active, the RX-complete ISR fires and initiates a single-beat DMA transfer configured for the full one-byte length. However, a received byte is already pending in the hardware SERCOM DATA register at this point. The peripheral-triggered DMA start then deposits the incoming byte at rx_buf[1] - one position past the end of the one-element buffer - because the ISR failed to consume the pre-buffered byte via CPU read before sizing the DMA. The fix restructures the ISR to read the first byte directly from the DATA register via CPU on initial receive, skipping DMA entirely for len1 buffers and reloading DMA for only the remaining len-1 bytes in larger buffers.
RemediationAI
Apply the upstream fix from commit 5251d2bc0070be801769fb7ce7b9066fef5d9f81 (https://github.com/zephyrproject-rtos/zephyr/commit/5251d2bc0070be801769fb7ce7b9066fef5d9f81), which restructures the async RX ISR to read the first incoming byte directly via CPU and bypasses DMA entirely for 1-byte buffers; a specific patched tagged release version was not confirmed in the available data, so monitor the Zephyr project release page for a version incorporating this commit. As the most effective compensating control, disable CONFIG_UART_MCHP_ASYNC in the project Kconfig if asynchronous UART is not operationally required - this eliminates the vulnerable code path entirely with no functional impact on synchronous UART use. If async mode is required, ensure all callers of uart_rx_enable() use receive buffers of at least two bytes; this prevents the overflow, though enforcing this at the application layer across a firmware codebase is fragile and should not substitute for the upstream patch.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today