Zephyr RTOS EUVD-2026-46447

Exploitation requires that the target device is built with and running the Zephyr MCTP-over-I2C+GPIO target binding (subsys/pmci/mctp/mctp_i2c_gpio_target.c) and that the attacker is a device acting as the I2C bus master on the same physical I2C bus as that target. No authentication and no prior MCTP protocol state are needed (the binding authenticates nothing): the NULL-deref path is triggered simply by writing the MCTP_I2C_GPIO_RX_MSG_ADDR (data) register before ever writing the length register, and the one-byte overflow is triggered by sending more than 255 data bytes. Limiting factors: it is not network-reachable (I2C-bus adjacency only, AV:A), it only affects builds that enable this specific PMCI binding, and it is confined to Zephyr v4.3.0 and v4.4.0; there is no confidentiality impact, and the practical prerequisite of controlling a device on the bus meaningfully constrains the attacker population versus the raw 8.1 score.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, base 8.1) is internally consistent with the description: exploitation requires adjacency on the shared I2C bus (AV:A), needs no authentication (PR:N) because the binding performs no authentication of the bus master, and needs no user interaction, while impact is high to integrity (attacker-chosen memory writes) and availability (hard fault/DoS) with no confidentiality loss (C:N). Realistic risk is bounded primarily by the adjacency requirement - an attacker must control or compromise a device on the same physical I2C bus, so this is not remotely reachable over a network and the exposure population is limited to boards that enable this specific PMCI/MCTP-over-I2C+GPIO target binding. There is no EPSS score, no KEV listing, and no POC in the provided data, so there are no signals of active or automatable exploitation; the value here is driven by the deterministic, no-precondition trigger for a malicious or even merely malfunctioning bus controller rather than by evidence of in-the-wild use. Net assessment: a genuine high-severity local/hardware-fabric issue for the subset of devices that ship the affected binding, but not an internet-facing mass-exploitation priority.

An attacker who controls or has compromised a device acting as I2C bus master on the same bus as a vulnerable Zephyr target selects the MCTP data pseudo-register and writes a single byte without first writing the length register, causing the target to store an attacker-chosen byte through a NULL rx_pkt pointer and crash or corrupt memory. Alternatively the master sends more than 255 data bytes to trigger the one-byte heap overflow at data[255]. No POC is published in the provided data, and no authentication or prior protocol state is required, so a malfunctioning peripheral could trigger the same fault accidentally.