CVE-2026-10678

Analyzed Analyzed - Analysis Complete

Memory Corruption in Zephyr RTOS via MCTP-over-I2C+GPIO

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: Zephyr Project

Description

The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive buffer was allocated: a controller that selects the data register and writes a byte without first sending the length register (which is what allocates the buffer) causes a write of an attacker-chosen byte through a NULL/unallocated mctp_pktbuf pointer (i.e. into a small attacker-advanceable offset above address 0), producing memory corruption or a hard fault. The same handler also performs a write-then-check bounds test, allowing a one-byte heap overflow at data[255] when more than 255 data bytes are sent. Because the I2C target callback is invoked with raw bytes supplied by whatever device is the bus master and the binding performs no authentication, a malicious or malfunctioning controller on the bus can trigger these without any prior protocol state, leading to memory corruption and/or denial of service on the target device. The vulnerable code was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-10678

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	From 4.3.0 (inc) to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is in Zephyr's MCTP-over-I2C+GPIO target binding. It allows a malicious controller on the I2C bus to cause memory corruption or denial of service by writing data without proper validation. The issue occurs when the receive buffer is not allocated but data is still written to it, leading to potential NULL pointer dereferencing or heap overflow.

Detection Guidance

This vulnerability requires detecting improper handling of MCTP-over-I2C+GPIO messages in Zephyr-based systems. Check for crashes or memory corruption when I2C bus masters send malformed messages. Monitor logs for NULL pointer dereferences or heap overflows in MCTP-related processes. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker on the same I2C bus to corrupt memory or crash the target device, causing denial of service. It may also enable unauthorized data manipulation depending on the device's configuration and memory layout.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling memory corruption or denial of service on a device. Unauthorized memory writes or crashes may lead to data integrity issues or unauthorized access, which are critical concerns under these regulations. The lack of authentication in the I2C target binding exacerbates this risk.

Mitigation Strategies

Update Zephyr to a patched version that includes the fix for the MCTP-over-I2C+GPIO target binding vulnerability. Ensure the fix defers buffer allocation until the first data byte and includes proper bounds checking before memory writes.

Hi! I’m here to help you understand CVE-2026-10678. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70