EUVD-2026-65599Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft ext2 image with oversized s_blocks_count
-
DeliveryInsert or present image to target device
-
ExploitDevice invokes ext2_mount() on media
-
Executionext2_init_fs() calls ext2_bitmap_count_set() without bounds check
-
Persist~512 MB OOB read crosses MPU boundary
-
ImpactSystem fault triggers denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker can supply a crafted ext2 image to a Zephyr device that will mount it - specifically via removable media (USB, SD card), a disk or flash partition, or a downloaded/provisioned image. The Zephyr ext2 filesystem driver must be compiled into the build (CONFIG_FILE_SYSTEM_EXT2=y). The CVSS vector (PR:L) indicates that some level of local access or physical interaction is needed to present the media, though on devices with auto-mount policies this may require only physical insertion. Exploitation is limited to denial of service (system fault/crash); the OOB read does not leak attacker-visible data, and no code execution or integrity impact is possible via this path. Devices that never mount externally supplied ext2 images are not exploitable. |
| Impact | The CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the limited blast radius: local access to mount media is required, and the only achievable outcome is a system crash. EPSS data is not provided; given no KEV listing and no public exploit, exploitation probability should be considered low. The vulnerability is not in CISA KEV, and no proof-of-concept code has been publicly identified at time of analysis. The high availability impact is real - a single malformed image reliably faults the device - but there is no confidentiality or integrity impact, since the OOB bit count is compared internally and never returned to the caller. The practical attack surface is restricted to systems where untrusted ext2 media (removable storage, downloaded images, provisioned flash partitions) can be presented to the Zephyr mount subsystem. For embedded product lines that accept field-inserted SD cards or USB drives, this warrants prompt patching; for devices with no external media interface, the risk is negligible. |
| Exploit ScenarioDerived | An attacker crafts a minimal ext2 image with s_blocks_count set to the maximum uint32 value (~4 billion) and places it on a USB drive or SD card. When an operator inserts the media into a Zephyr-based device that auto-mounts external storage, ext2_mount() is called, ext2_bitmap_count_set() iterates ~512 MB past the allocated bitmap block, crosses an MPU-protected boundary, and the device faults and reboots or halts - achieving denial of service with a single media insertion. No public exploit code exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.
RemediationAI
Apply upstream commit 9c0f869da07009d9d4bca7a99e995f9b8cea7da2 from the Zephyr project repository (https://github.com/zephyrproject-rtos/zephyr/commit/9c0f869da07009d9d4bca7a99e995f9b8cea7da2), which adds a bounds check rejecting any ext2 image whose fs_blocks exceeds block_size × 8 before the bitmap scan. Downstream integrators should verify whether their vendor SDK or board support package has incorporated this fix, as Zephyr is typically consumed as a vendored copy. If immediate patching is not possible, the most effective compensating control is to disable ext2 filesystem support (CONFIG_FILE_SYSTEM_EXT2=n) in the build configuration, with the trade-off that any application relying on ext2 storage will cease to function. Where ext2 must remain enabled, restrict the set of trusted sources from which ext2 images can be mounted - for example, rejecting externally supplied removable media at the application layer before calling the mount API - accepting that this is a policy control rather than a code-level fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zephyr is an open-source RTOS (cpe:2.3:a:zephyrproject:zephyr) widely used in IoT and embedded systems. Its ext2 filesystem driver (subsys/fs/ext2/ext2_impl.c) calls ext2_init_fs() during mount to validate the on-disk block bitmap. The helper ext2_bitmap_count_set() (subsys/fs/ext2/ext2_bitmap.c) iterates one byte per eight bits, assuming the input 'fs_blocks' is bounded by the single fetched bitmap block (BGROUP_BLOCK_BITMAP), which is at most block_size bytes = block_size × 8 bits. The superblock validation function ext2_verify_disk_superblock() checks magic, revision, and block-size shift but never checks that s_blocks_count fits within that capacity. CWE-125 (Out-of-bounds Read) is the root cause: attacker-controlled superblock data is used as an iteration bound without sanitization, violating the spatial memory safety of the static block slab region.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local vector because attacker must supply physical or provisioned media; low privileges reflect typical user-level mount access; no confidentiality or integrity impact confirmed.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
DescriptionCVE.org
The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_first_data_block to ext2_bitmap_count_set(). That helper (subsys/fs/ext2/ext2_bitmap.c) treats its argument as a number of bits and reads one bitmap byte per eight bits, but the bitmap buffer (BGROUP_BLOCK_BITMAP) is a single fetched block of only fs->block_size bytes (capacity fs->block_size * 8 bits). s_blocks_count and s_first_data_block are taken verbatim from the superblock and were never bounded against this single-group capacity; ext2_verify_disk_superblock() checks the magic, revision, and block-size shift but not the block count.
A crafted ext2 image with an oversized s_blocks_count (up to ~4 billion, against a maximum 4096-byte block / 32768-bit bitmap) makes ext2_bitmap_count_set() scan roughly 512 MB of memory past the bitmap block - a large out-of-bounds read of the static block slab and adjacent memory.
The defect is reached during mount: ext2_init_fs() is invoked from ext2_mount() (subsys/fs/ext2/ext2_ops.c), the registered .mount operation. Any path that mounts an attacker-supplied ext2 image (removable media, a disk/flash partition, or a downloaded image) triggers it. The kernel-privileged parser operates on attacker-controlled data, so the bug is exploitable wherever untrusted ext2 media can be mounted.
Impact is an out-of-bounds read only: the resulting bit count is compared internally and the mount is rejected, so no attacker-controlled bytes are returned (not a useful information leak). The ~512 MB over-read will almost certainly cross an unmapped or MPU-protected boundary and fault, crashing the system - a denial of service triggered by mounting a single malformed image. The fix rejects any image whose fs_blocks exceeds fs->block_size * 8 before the scan.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB