What is the CVSS score of CVE-2026-10645?

CVE-2026-10645 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Zephyr RTOS CVE-2026-10645

Q: Which versions of Zephyr RTOS are affected by CVE-2026-10645?

Out-of-bounds read and denial-of-service in Zephyr RTOS's ext2 filesystem parser expose embedded devices to filesystem-level attacks via maliciously crafted disk images.

MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-22 zephyr

Buffer Overflow Denial Of Service Information Disclosure Path Traversal Zephyr Zephyrproject Rtos

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (zephyr) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Physical media delivery required (AV:P); mount and traversal constitute user interaction (UI:R); OOB read yields low confidentiality, no integrity impact, but crash/infinite-loop yields high availability loss.

3.1 AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 06, 2026 - 19:52 NVD

4.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 23, 2026 - 00:43 vuln.today

DescriptionNVD

Zephyr's ext2 directory-entry parser does not fully validate on-disk directory entry structure before copying the entry name and advancing traversal state. In ext2_fetch_direntry() (subsys/fs/ext2/ext2_diskops.c), the code only checks de_name_len <= EXT2_MAX_FILE_NAME and then copies the name with memcpy without validating the structural relationship between de_rec_len, de_name_len, and the directory block boundary (for example that de_rec_len is non-zero, at least the size of the entry header, and that the record fits within the block). Callers such as find_dir_entry() and ext2_get_direntry() (subsys/fs/ext2/ext2_impl.c) then advance traversal using the unvalidated de_rec_len. A crafted ext2 image can therefore cause an out-of-bounds read from the directory block buffer when a malformed entry near the end of a block triggers an oversized name copy, or a zero-progress infinite loop when de_rec_len == 0. The issue is not reached at mount time but later through directory traversal paths such as pathname lookup, stat/open/unlink/rename, and readdir. The primary impact is denial of service and out-of-bounds reads under attacker-controlled ext2 images mounted from untrusted media.

AnalysisAI

Out-of-bounds read and denial-of-service in Zephyr RTOS's ext2 filesystem parser expose embedded devices to filesystem-level attacks via maliciously crafted disk images. The flaw resides in ext2_fetch_direntry() (subsys/fs/ext2/ext2_diskops.c), where insufficient validation of on-disk directory entry fields - specifically de_rec_len and de_name_len against block boundaries - allows a crafted ext2 image to trigger an oversized memcpy (out-of-bounds read) or a zero-progress infinite loop when de_rec_len equals zero. All Zephyr versions are indicated as affected per the wildcard CPE, no public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability lives in Zephyr's implementation of the ext2 filesystem (subsys/fs/ext2/), a POSIX-compatible filesystem format originally from Linux that Zephyr has implemented for embedded/IoT storage targets (CPE: cpe:2.3:a:zephyrproject-rtos:zephyr:*:*:*:*:*:*:*:*). The root cause (CWE-125, Out-of-bounds Read) is the lack of structural integrity checks on directory entry fields before use. An ext2 directory block contains a linked list of variable-length entries, each described by a header carrying de_rec_len (record length, used to advance the traversal pointer) and de_name_len (filename length, used in the memcpy). The code validates only that de_name_len <= EXT2_MAX_FILE_NAME but does not enforce that de_rec_len is non-zero, that it is at least as large as the entry header, or that de_rec_len + current_offset does not exceed the block boundary. Callers find_dir_entry() and ext2_get_direntry() in ext2_impl.c then blindly advance traversal state using this unvalidated offset, allowing a crafted image to walk the traversal pointer out of the allocated directory block buffer or spin in an infinite loop. The vulnerability is not exercised at mount time - it requires an explicit directory traversal operation such as pathname lookup, open, stat, unlink, rename, or readdir.

RemediationAI

Consult the Zephyr project's GitHub Security Advisory (GHSA-hwrh-9h3x-vccm) for the authoritative patch version, as no specific fixed release version was included in the available intelligence data; the patch status is therefore 'upstream fix available per vendor advisory - patched release version not independently confirmed.' Developers and integrators should update to the latest Zephyr release and monitor the advisory for a confirmed fix tag. As a compensating control where an upgrade cannot be immediately applied, disable ext2 filesystem support in the Zephyr build configuration if untrusted removable media scenarios are present, accepting the trade-off of losing ext2-formatted storage interoperability. Additionally, restrict physical media attachment interfaces (e.g., SD card or USB mass storage) to trusted sources via hardware or policy controls, which eliminates the physical-vector attack path entirely. Where directory traversal operations over ext2-mounted volumes can be gated behind a privilege boundary, doing so limits the blast radius to processes with mount permissions.