Zephyr RTOS EUVD-2026-107482

Exploitation requires a Zephyr firmware build that enables the Broadcom AFBR-S50 driver (devicetree compatible brcm,afbr-s50); unaffected if the driver is not compiled in. The attacker must be within optical range of the sensor to force Argus_EvaluateData() into a non-STATUS_OK branch - achievable by introducing harsh ambient light or sharp distance transitions into the sensor's field of view (and in releases before the payload.Status check was dropped, ordinary sharp distance transitions sufficed); SPI transfer errors reach the same branch. No physical contact with the board, no software access, and no authentication are needed. Limiting factors: only streaming (multishot) and one-shot RTIO submissions on affected builds are impacted, exploitation demands physical proximity to the sensor (AV:P), and the attacker cannot control the corrupted memory content, so outcomes are limited to crashes/availability loss rather than controlled compromise.

This is a genuine but comparatively low-priority defect whose signals are internally consistent toward a moderate rating. The provided CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, base 5.2) is the dominant anchor: the attack vector is Physical (AV:P), meaning the trigger requires proximity to the optical sensor rather than network reach, which sharply limits mass or remote exploitation. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit code is referenced - only a vendor patch commit and a GitHub Security Advisory (GHSA-559f-34rc-pgw2). No SSVC decision data was supplied. The technical impact is a CWE-415 double-free/double-completion corrupting the RTIO submission pool, with availability impact High and integrity Low; crucially the description states the attacker does NOT control the corrupted content, so this is availability/memory-corruption, not code execution. Note the tension between the AV:P vector and the ease of triggering: the failure branch is driven by sensor conditions (harsh ambient light, sharp distance transitions, SPI errors) and needs no physical contact or software access, so the barrier is physical proximity to the sensor's field of view, not authentication or privilege. Net: a real correctness bug worth patching on affected embedded builds, but not a widespread exploitation priority - the Physical vector and the niche affected driver keep real-world risk modest.

An actor positioned in front of a Zephyr-based device's AFBR-S50 time-of-flight sensor shines harsh ambient light or creates sharp distance transitions in the sensor's field of view, causing Argus_EvaluateData() to return a non-STATUS_OK status. The error branch completes the RTIO submission with rtio_iodev_sqe_err() but fails to return, so the same submission is completed a second time with rtio_iodev_sqe_ok(), double-freeing the pool entry and corrupting submission/mempool bookkeeping, leading to memory corruption and loss of availability. No public exploit code is identified, and the physical attack vector (AV:P) with low complexity (AC:L) means proximity to the sensor - not network access - is the key prerequisite.