Unbounded Out-of-Bounds Heap Write in LevelX NAND Flash-Translation Layer

CVE-2026-102730

What is CVE-2026-102730?

An attacker can exploit a flaw in LevelX's NAND flash-translation-layer metadata parser, allowing for an unbounded out-of-bounds heap write. This results in the potential for an attacker to control function pointers within the driver’s control block, which may lead to arbitrary code execution through control-flow hijacking. The flaw is attributed to improper handling of NAND flash images, which can result in critical data being overwritten. There are additional implications highlighted by accompanying out-of-bounds read vulnerabilities, compounding the security risks.

References