EUVD-2026-50445Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L
Local-only vector, high privilege required to reach coredump shell, high complexity to stage malformed storage; impact limited to partial memory read or local crash.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
Lifecycle Timeline
2DescriptionCVE.org
In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header directly as an index into coredump_target_code2str[], a fixed 7-element array of string pointers, with no bounds check.
A stored coredump whose tgt_code is >= 7 causes an out-of-bounds read of a char* up to ~64K entries past the array; that value is passed as the %s argument to shell_print, which dereferences and walks it as a string. The result is either disclosure of device memory contents to the shell user or a crash when the out-of-bounds pointer is unmapped.
The defect is reached via the coredump print shell command (cmd_coredump_print_stored_dump -> pretty_print_coredump -> parse_and_print_coredump -> print_coredump_hdr). The tgt_code field is device-generated and in-range during normal crash handling, so triggering requires local shell access plus the ability to stage or corrupt the stored coredump in the flash/in-memory backend.
Introduced in v4.2.0 (commit 13abd7fe730) and present through v4.4.0; fixed by clamping out-of-range codes to the 'unknown' (index 0) entry.
AnalysisAI
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
Technical ContextAI
The defect resides in subsys/debug/coredump/coredump_shell.c within the Zephyr real-time operating system's debug subsystem, specifically in print_coredump_hdr(), which is invoked through the call chain cmd_coredump_print_stored_dump -> pretty_print_coredump -> parse_and_print_coredump -> print_coredump_hdr. The function maps a uint16_t tgt_code field from a stored coredump header to a human-readable architecture name via coredump_target_code2str[], a static array of exactly 7 char* pointers. Because tgt_code (range 0-65535) is passed directly as an array index without a bounds check, any value >= 7 constitutes a CWE-125 (Out-of-Bounds Read): the read char* is then passed to shell_print() as a %s argument, causing the shell to dereference and walk whatever pointer value resides in memory past the array end. The result is either leakage of adjacent memory regions (if the pointer happens to be mapped and readable) or a fault/crash (if the pointer is unmapped). The affected CPE is cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:* for versions 4.2.0 through 4.4.0, with the defect introduced by commit 13abd7fe730.
RemediationAI
Apply the upstream fix available at https://github.com/zephyrproject-rtos/zephyr/commit/a9226324e8bd1f8adecafb1b6e0603f781dc750c, which adds a bounds check that clamps any tgt_code value >= ARRAY_SIZE(coredump_target_code2str) to index 0 (the 'unknown' entry) before using it as an array subscript. The patch is confirmed by the Zephyr security advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9fw2-4429-49q8; however, a specific tagged release version incorporating this fix was not independently confirmed from the provided data - consult Zephyr project release notes to identify the first tagged release containing commit a9226324e8bd. As an immediate compensating control, disable the coredump shell command subsystem at build time via CONFIG_DEBUG_COREDUMP_SHELL=n in the project's Kconfig; this removes the entire vulnerable code path with the trade-off of losing runtime coredump introspection capability. Alternatively, restrict Zephyr shell access (CONFIG_SHELL) to eliminate the privilege path entirely, accepting the loss of all shell-based diagnostics.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today