Zephyr RTOS CVE-2026-10645

Exploitation requires that the target Zephyr device has ext2 filesystem support compiled into the build and that the attacker can physically supply a removable storage medium (e.g., SD card, USB mass storage) formatted as a crafted ext2 image to the device. The vulnerability is not reachable at mount time - a directory traversal operation (pathname lookup, open, stat, unlink, rename, or readdir) on the mounted volume must subsequently occur, either triggered by the user or automatically by firmware logic. Limiting factors: AV:P confines exploitation to actors with physical access to the device and its media slot; UI:R requires that a mount and subsequent traversal take place; devices that never mount untrusted ext2 media are entirely unaffected; the vulnerability is absent if ext2 support is not enabled in the build configuration.

The CVSS 3.1 base score of 4.9 (Medium) with vector AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H accurately reflects the constrained real-world attack surface: physical media access is required (AV:P), and a user or system process must mount the crafted image and then perform directory traversal (UI:R). The physical vector substantially limits exploitability compared to network-reachable vulnerabilities. No EPSS data was provided in the available intelligence, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. The dual impact - out-of-bounds read (C:L) and potential high-severity availability loss via infinite loop or crash (A:H) - is credible for embedded targets where a DoS may be persistent until manual intervention. The out-of-bounds read could disclose adjacent heap or stack memory from the filesystem buffer, but exploitation for targeted information disclosure would require precise control of buffer layout. The primary realistic risk is denial of service against IoT or embedded devices that accept removable ext2-formatted storage from untrusted sources. No POC or exploit tooling has been identified, further tempering urgency.

An attacker crafts a malicious ext2 disk image containing a directory block with a directory entry near the end of the block where de_name_len is set to a value that, combined with the entry's position, exceeds the block boundary, or sets de_rec_len to zero. The attacker physically delivers this media (e.g., an SD card or USB drive) to a Zephyr-based IoT device that auto-mounts removable storage. When the device firmware performs any directory traversal - such as a file open or a directory listing on the mounted volume - ext2_fetch_direntry copies beyond the block buffer boundary or enters an infinite loop, causing memory disclosure or a system hang. No public proof-of-concept has been identified at time of analysis.