CVE-2026-10678

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.3.0 through 4.4.0

Description The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp i2c gpio target.c processes pseudo-register writes from an I2C bus master byte-by-byte in the mctp i2c gpio target write received() function without validating the order or the receive buffer. The MCTP I2C GPIO RX MSG ADDR (data) handler dereferences and writes through b->rx pkt without verifying if the receive buffer was allocated. If a controller writes a byte to the data register without first sending the length register, it causes a write of an attacker-chosen byte through a NULL or unallocated mctp pktbuf pointer, leading to memory corruption or a hard fault. Additionally, the handler performs a write-then-check bounds test, which allows a one-byte heap overflow at data[255] when more than 255 data bytes are sent. Since the I2C target callback is invoked with raw bytes and lacks authentication, a malicious or malfunctioning controller on the bus can trigger these issues, resulting in memory corruption or denial of service.

Recommendations Update Zephyr versions 4.3.0 through 4.4.0 to a version containing the fix that implements a NULL check for allocation on the first data byte, treats missing length as a zero-sized packet, and moves the bounds check before the store operation.