An out-of-bounds write occurs in the Microchip SERCOM-G1 UART driver when asynchronous DMA receive is enabled and a caller requests a one‑byte receive buffer. The DMA engine writes one byte past the end of the supplied buffer, exposing the adjacent memory to overwrite with received UART data. This flaw can induce a single‑byte memory corruption that may lead to a crash or denial of service, but it does not provide direct code execution or broader system compromise.

The vulnerability affects the Zephyr kernel when it includes the Microchip SERCOM-G1 UART driver for the PIC32CM‑JH family of SoCs. The defect was present in kernel version 4.4.0 and earlier; any release that has not incorporated the specific commit that disables DMA for one‑byte buffers remains vulnerable.

The CVSS score of 4.2 indicates a medium impact severity. EPSS is not available, and the issue is not recorded in CISA’s KEV catalog, suggesting limited public exploitation. The exploit requires that asynchronous UART is configured (CONFIG_UART_MCHP_ASYNC enabled) and that a user explicitly enables a one‑byte receive buffer; these prerequisites are not enabled by default on the in‑tree PIC32CM‑JH boards. While the attack surface is narrow, an adjacent attacker connected to the UART could trigger the overflow and cause a crash if the conditions are met.