CVE-2026-10684

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.2.0 through 4.4.0

Description In the print coredump hdr() function, the 16-bit tgt code field of a stored coredump header is used as an index for the coredump target code2str[] array without a bounds check. If the tgt code is 7 or greater, it triggers an out-of-bounds read of a character pointer. This pointer is then passed to shell print, which dereferences it as a string, potentially leading to the disclosure of device memory contents to a shell user or causing a system crash if the pointer is unmapped. This issue is reachable via the coredump print shell command through the sequence cmd coredump print stored dump -> pretty print coredump -> parse and print coredump -> print coredump hdr(). Exploitation requires local shell access and the ability to stage or corrupt the stored coredump in the flash or in-memory backend.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary workaround, restrict local shell access to prevent unauthorized users from executing the coredump print command.