CVE-2026-102730
Awaiting Analysis Awaiting Analysis - Queue

Heap-Based Buffer Overflow in LevelX NAND Flash Parser

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Eclipse Foundation

Description
Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102730
EUVD
EUVD-2026-89201

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
levelx nand_flash_translation_layer *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based out-of-bounds write vulnerability in LevelX's NAND flash-translation-layer metadata parser. When an attacker provides a specially crafted NAND flash image, it triggers an unbounded write that overwrites a driver function pointer in the control block. This allows an attacker to hijack the control flow by setting the RIP to an attacker-chosen value, leading to potential arbitrary code execution.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary code on the affected system with the same privileges as the vulnerable application. It could lead to data breaches, system compromise, or denial of service. The impact depends on the context in which LevelX is used, such as embedded systems or IoT devices.

Mitigation Strategies

Update or patch the LevelX NAND flash-translation-layer component to address the unbounded out-of-bounds heap write vulnerability. Disable or restrict access to the affected lx_nand_flash_open() function if possible. Monitor for unusual control-flow hijacking or memory corruption patterns in system logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart