Zephyr NPCX eSPI CVE-2026-78119

Exploitable only when CONFIG_ESPI_TAF is enabled on a Nuvoton NPCX/NPCK SoC target (no in-tree Zephyr board enables this by default), and only via a TAF write or RPMC OP1 flash request whose 12-bit header length field exceeds the negotiated eSPI receive payload size (rx-plsize, 64 bytes on all in-tree SoCs). The attacker must control the eSPI host at the firmware or bus level, not merely run software on the host; a compliant maximum-length (64-byte) write fits the buffer exactly and is processed safely. Primary limiting factors: non-default build configuration, specific Nuvoton hardware, and the requirement for host-firmware/bus-level control rather than ordinary host access.

This is a medium-severity (CVSS 6.3) out-of-bounds write (CWE-787) whose real-world priority is constrained by its access requirements rather than its impact. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H correctly captures the key limiter: AV:L and PR:H mean exploitation is not reachable from ordinary host software or over a network - the description explicitly states it requires host firmware or bus-level control over the eSPI link, which is a substantial barrier. No EPSS score, KEV listing, or POC was provided in the intelligence, so this is no public exploit identified at time of analysis and there is no evidence of active or widespread exploitation. The impact is genuine where exploitable (I:H/A:H from .bss corruption that can disable flash protection regions, plus C:L from leaking adjacent controller SRAM into host-readable flash), and it crosses the exact trust boundary TAF exists to enforce. Weighing the signals together: this is a real, well-characterized memory-corruption flaw but a conditional, high-privilege, local-bus one - a priority for high-assurance embedded/EC deployments that enable TAF, but low operational urgency for the vast majority of environments. No signals conflict; the main gap is the absence of EPSS/KEV/POC data, which is consistent with a hardware-adjacent, non-default-configuration vulnerability.

A malicious or compromised eSPI host (host firmware or a device with bus-level control) emits a Target-Attached-Flash write or RPMC OP1 request whose 12-bit header length field claims a payload larger than the negotiated 64-byte rx-plsize. The embedded controller's espi_taf_parse() copies up to 239 extra 32-bit words past the fixed 16-word src buffer, corrupting roughly 956 bytes of .bss and potentially leaking adjacent controller SRAM into host-chosen flash the attacker can read back. No public POC was identified; exploitation requires crafting a non-compliant TAF request, which is low-complexity once bus/firmware control is held.