An out-of-bounds write occurs in the Microchip SERCOM-G1 UART driver when asynchronous DMA receive is enabled and a one-byte receive buffer is requested. During the RX-complete interrupt service routine, the driver initiates a single-beat DMA transfer while a byte is already pending in the SERCOM DATA register; on this SoC the DMA writes one byte past the end of the supplied buffer. The overflowed byte is the UART RX data supplied by an adjacent attacker and it lies immediately after the buffer. Consequently, a single-byte memory corruption adjacent to the RX buffer can occur, potentially causing a crash or denial of service, but it does not provide direct code execution or broader system compromise.

The vulnerability affects the Zephyr kernel when it includes the Microchip SERCOM-G1 UART driver for the PIC32CM-JH family of SoCs. The defect was present in kernel version 4.4.0 and earlier; any release that has not incorporated the specific commit that disables DMA for one-byte buffers remains vulnerable.

The CVSS score of 4.2 indicates a medium impact severity. The EPSS score of 0.00148 (0.148%) indicates a very low exploitation probability, and the issue is not recorded in CISA's KEV catalog, suggesting limited public exploitation. The exploit requires that asynchronous UART is configured (CONFIG_UART_MCHP_ASYNC enabled) and that a user explicitly enables a one-byte receive buffer; these prerequisites are not enabled by default on the in-tree PIC32CM-JH boards. While the attack surface is narrow, an adjacent attacker connected to the UART could trigger the overflow and cause a crash if the conditions are met.