Zephyr RTOS EUVD-2026-84013

Requires an intel_ish_5_* (or equivalent SEDI IPM) Zephyr target where an application has registered an IPM receive callback via ipm_register_callback() - the driver's normal mode of use - AND host-side software possessing ISH driver-level or raw BAR access to the device's memory-mapped register window, from which the peer-written doorbell register can be set. Exploitation further depends on a production image built WITHOUT CONFIG_DEBUG, since the underlying HAL sedi_ipc_read_msg() bounds check is a DBG_CHECK that compiles away otherwise. Limiting factors: local attack vector (no network reach), high privilege on the host side (driver/raw BAR access), and the platform-specific SEDI IPM driver being compiled in - this is not remotely reachable and not present in default non-Intel-ISH Zephyr builds.

This is a moderate, defense-in-depth-relevant flaw rather than an urgent internet-facing emergency. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H = 6.0) is internally consistent with the description: the doorbell register is reached only through the device's memory-mapped BAR window, so the attacker must already be host-side software with driver-level or raw BAR access (AV:L, PR:H). No EPSS score, no CISA KEV entry, and no public exploit are present in the input - so exploitation status is 'no public exploit identified at time of analysis.' The impact is genuine (I:H/A:H): an interrupt-context out-of-bounds write of up to 895 bytes into .bss that corrupts kernel synchronization primitives, but the description frames the outcome as a 'kernel data-structure corruption and crash primitive' - i.e., a demonstrated DoS/integrity primitive, not confirmed arbitrary code execution, which is why C:N is appropriate. Note one debatable point to verify with the vendor: because the attacker on the host CPU crosses a trust boundary into the separate ISH co-processor running Zephyr, a Scope-changed (S:C) reading is arguable, though impact remains confined to the ISH so S:U is defensible. Overall: real bug, patch available, but the PR:H/AV:L gating and absence of any exploitation signal put it below internet-facing critical issues in priority.

On an intel_ish_5_* platform where a Zephyr application has registered an IPM receive callback (the driver's normal mode), a host-side actor with ISH driver or raw BAR access writes a doorbell register encoding a payload length larger than 128 (up to the 10-bit maximum of 1023). When the inbound-message interrupt fires, ipm_event_dispose() copies that oversized length into the 128-byte incoming_data_buf, overflowing up to 895 bytes into adjacent static memory and corrupting the k_sem/k_mutex used by the transmit path, crashing or corrupting the ISH kernel. No public exploit code is identified in the provided data.