EUVD-2026-46447Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
I2C-bus adjacency gives AV:A; no auth or prior state gives PR:N/AC:L; attacker-chosen writes and hard faults give I:H/A:H with no data disclosure (C:N).
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
Lifecycle Timeline
3DescriptionCVE.org
The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive buffer was allocated: a controller that selects the data register and writes a byte without first sending the length register (which is what allocates the buffer) causes a write of an attacker-chosen byte through a NULL/unallocated mctp_pktbuf pointer (i.e. into a small attacker-advanceable offset above address 0), producing memory corruption or a hard fault.
The same handler also performs a write-then-check bounds test, allowing a one-byte heap overflow at data[255] when more than 255 data bytes are sent.
Because the I2C target callback is invoked with raw bytes supplied by whatever device is the bus master and the binding performs no authentication, a malicious or malfunctioning controller on the bus can trigger these without any prior protocol state, leading to memory corruption and/or denial of service on the target device.
The vulnerable code was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store.
AnalysisAI
Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.
Technical ContextAI
The affected component is Zephyr's Platform Management Component Intelligence (PMCI) stack, specifically the MCTP (Management Component Transport Protocol) transport binding that carries MCTP packets over I2C using a GPIO signal, implemented in subsys/pmci/mctp/mctp_i2c_gpio_target.c. The target exposes pseudo-registers (a length register that calls mctp_pktbuf_alloc() to allocate a receive buffer, and a data register that stores incoming bytes) and processes bus-master writes byte-by-byte in mctp_i2c_gpio_target_write_received(). The root cause maps to CWE-476 (NULL Pointer Dereference): the data handler dereferences b->rx_pkt and writes b->rx_pkt->data[b->rx_idx] without confirming the buffer was ever allocated, so if the length register is never written, rx_pkt is NULL and the store lands at a small, attacker-advanceable offset above address 0. A second defect is an out-of-bounds write (write-then-check ordering) that overflows data[255] by one byte. The commit adds an rx_exp_len field, defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet that libmctp rejects, and moves the bounds check before the store.
RemediationAI
Apply the upstream fix from commit 9e23364261a2188c171d734d6947e02ee2a9510f (https://github.com/zephyrproject-rtos/zephyr/commit/9e23364261a2188c171d734d6947e02ee2a9510f), which defers packet-buffer allocation to the first data byte behind a NULL check, treats a missing length register as a zero-sized packet rejected by libmctp, and moves the bounds check before the store; track the Zephyr advisory GHSA-pmwm-5rcm-39rr for the tagged patched release, since patch data indicates a vendor fix is available but a released patched version tag is not independently confirmed in the provided data. Because the fix currently references a commit rather than a confirmed tagged release, rebuild affected firmware from a Zephyr tree that includes this commit rather than assuming a specific version number. Where firmware cannot be updated immediately, compensating controls should focus on the I2C fabric: ensure only trusted, vetted devices share the bus with the vulnerable target (physically or by bus topology), and if the MCTP-over-I2C+GPIO target functionality is not required, disable/exclude that binding from the build to remove the attack surface entirely - the trade-off is loss of MCTP management transport on that bus. There is no purely software workaround on the target side short of the code fix, since the flaw is triggered by raw bytes from the bus master.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today