What is the CVSS score of CVE-2026-10664?

CVE-2026-10664 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-10664?

Yes, a patch is available for CVE-2026-10664. Update the affected software to the latest version immediately.

Zephyr nRF70 Driver CVE-2026-10664

EUVD-2026-43241 MEDIUM

Out-of-bounds Write (CWE-787)

2026-07-12 zephyr

Memory Corruption Buffer Overflow Zephyr

5.0

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

5.0 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

5.0 MEDIUM

Adjacent vector captures co-processor/AP indirect path; AC:H reflects multi-step rogue-AP-to-firmware manipulation required; C:L for OOB read, I:L/A:L for stack corruption.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 17:28 vuln.today

DescriptionCVE.org

The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow entries from an nrf_wifi_umac_event_power_save_info event into the fixed-size twt_flows[WIFI_MAX_TWT_FLOWS] (8-element) array of a caller-supplied struct wifi_ps_config, looping over event-provided num_twt_flows without validating it against WIFI_MAX_TWT_FLOWS or checking event_len. When num_twt_flows exceeds 8, the handler writes past the destination array (which is typically on the caller's stack, e.g. the wifi ps shell command) -- an out-of-bounds write of ~40-byte TWT entries -- and reads twt_flow_info[i] past the event buffer. The event is delivered by the nRF70 co-processor firmware in response to a host-initiated power-save GET, so reaching the overflow requires the firmware to emit a malformed or out-of-range event; the trust boundary is host-to-trusted-coprocessor rather than a direct remote-AP write, with over-the-air influence on the flow count being indirect and bounded by the 3-bit TWT flow-id space. Affected: builds with CONFIG_NRF70_STA_MODE on releases through v4.4.0. The fix rejects events with num_twt_flows > WIFI_MAX_TWT_FLOWS or with event_len shorter than the claimed entries, and adds a NULL check on the caller buffer.

AnalysisAI

Out-of-bounds stack write in Zephyr's nRF70 Wi-Fi driver exposes embedded systems to memory corruption when the nRF70 co-processor returns a power-save event with more than eight TWT flow entries. The vulnerable function nrf_wifi_event_proc_get_power_save_info() blindly copies co-processor-supplied TWT entries into a fixed 8-element stack array without validating num_twt_flows against WIFI_MAX_TWT_FLOWS, enabling heap/stack corruption of approximately 40 bytes per excess entry. No public exploit code exists and the flaw is not listed in CISA KEV, but the adjacent-network attack vector and the indirect over-the-air influence path via a rogue AP manipulating TWT sessions make this a meaningful risk in Wi-Fi 6 (802.11ax) deployment environments running Zephyr with CONFIG_NRF70_STA_MODE.

Technical ContextAI

Target Wake Time (TWT) is an 802.11ax (Wi-Fi 6) power-management protocol allowing stations to negotiate scheduled wake windows with an AP. The Zephyr RTOS nRF70 Wi-Fi driver (CPE: cpe:2.3:a:zephyrproject:zephyr) offloads Wi-Fi stack processing to the Nordic nRF70 series co-processor; the host driver consumes structured UMAC events from that co-processor. The root cause is CWE-787 (Out-of-Bounds Write): nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c iterates num_twt_flows times, copying each twt_flow_info[i] entry into wifi_ps_config.twt_flows[], a statically-sized 8-element array (WIFI_MAX_TWT_FLOWS = 8). Neither the loop count nor the event buffer length (event_len) is validated, so a co-processor event advertising more than eight flows causes an OOB write beyond the destination array (typically on the caller's stack, e.g., the wifi ps shell command) and an OOB read past the end of the event buffer. The fix (commit a2c4324) adds a bounds check rejecting num_twt_flows > WIFI_MAX_TWT_FLOWS and a length check on event_len, plus a NULL guard on the caller buffer.

RemediationAI

Integrate the upstream fix commit a2c4324acd50a5f92e492e6e460e6297af826148 from https://github.com/zephyrproject-rtos/zephyr/commit/a2c4324acd50a5f92e492e6e460e6297af826148 - this patch rejects events with num_twt_flows > WIFI_MAX_TWT_FLOWS, validates event_len against the claimed entry count, and adds a NULL check on the destination buffer, fully closing the overflow. If integrating the patch immediately is not feasible, a targeted compensating control is to disable TWT support at build time by omitting CONFIG_NRF70_STA_MODE or disabling TWT negotiation at runtime, though this sacrifices Wi-Fi 6 power-save efficiency on battery-constrained devices. An additional network-level mitigation is to restrict device connectivity to trusted, enterprise-managed APs that reject anomalous TWT flow counts, though this does not eliminate risk from a compromised co-processor. Monitor GHSA-3r6j-pm38-r43m at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3r6j-pm38-r43m for an official tagged release incorporating the fix.