Memory Corruption in Zephyr's I2C+GPIO Target Binding

CVE-2026-10678

What is CVE-2026-10678?

The MCTP-over-I2C+GPIO target binding in Zephyr processes pseudo-register writes from an I2C master without validating the order of received data. This oversight allows for attacks that can produce memory corruption or cause denial of service on the affected device. Specifically, an attacker could write data without the necessary protocol state, leading to a dereference of an unallocated memory buffer, which can corrupt memory or cause the system to fail. Additionally, when more than 255 data bytes are sent, it allows for a one-byte heap overflow, compounding the potential impact. The vulnerability originated when this binding was introduced in Zephyr versions 4.3.0 and 4.4.0.

References