Out-of-Bounds Write Vulnerability in Nuvoton NPCX eSPI Driver

CVE-2026-78119

What is CVE-2026-78119?

A vulnerability in the Nuvoton NPCX eSPI driver allows for an out-of-bounds write due to improper validation of payload size. The driver fails to check the length of Target-Attached-Flash (TAF) requests against its defined buffer size before copying data, allowing an attacker to exploit this flaw by sending a specially crafted request. This could lead to memory corruption, controller crashes, or hangs, ultimately compromising the integrity of the embedded system. The issue arises specifically when the host firmware violates negotiated payload limits, hence crossing trust boundaries and disrupting expected interactions between the host and the embedded controller.

References