zephyrproject Zephyr up to 4.4.x MCTP I2C GPIO Target Binding mctp_i2c_gpio_target.c mctp_i2c_gpio_target_write_received rx_pkt heap-based overflow

Summaryinfo

A vulnerability was found in zephyrproject Zephyr up to 4.4.x and classified as problematic. This vulnerability affects the function mctp_i2c_gpio_target_write_received of the file subsys/pmci/mctp/mctp_i2c_gpio_target.c of the component MCTP I2C GPIO Target Binding. Such manipulation of the argument rx_pkt leads to heap-based overflow. This vulnerability is listed as CVE-2026-10678. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in zephyrproject Zephyr up to 4.4.x. Affected by this issue is the function mctp_i2c_gpio_target_write_received of the file subsys/pmci/mctp/mctp_i2c_gpio_target.c of the component MCTP I2C GPIO Target Binding. The manipulation of the argument rx_pkt with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is integrity, and availability. CVE summarizes:

The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive buffer was allocated: a controller that selects the data register and writes a byte without first sending the length register (which is what allocates the buffer) causes a write of an attacker-chosen byte through a NULL/unallocated mctp_pktbuf pointer (i.e. into a small attacker-advanceable offset above address 0), producing memory corruption or a hard fault. The same handler also performs a write-then-check bounds test, allowing a one-byte heap overflow at data[255] when more than 255 data bytes are sent. Because the I2C target callback is invoked with raw bytes supplied by whatever device is the bus master and the binding performs no authentication, a malicious or malfunctioning controller on the bus can trigger these without any prior protocol state, leading to memory corruption and/or denial of service on the target device. The vulnerable code was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-10678 since 06/02/2026. The exploitation is known to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading to version 4.5.0 eliminates this vulnerability. Applying the patch 9e23364261a2188c171d734d6947e02ee2a9510f is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Vendor

• zephyrproject

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion