Zephyr’s ext2 directory–entry parser does not fully validate the on‑disk layout before copying an entry’s name or advancing the traversal pointer. The code checks only the name length and then uses a raw memcpy based on an unverified record length field. This allows an attacker to craft a malformed directory entry that causes an out‑of‑bounds read in the directory block buffer or a zero‑progress infinite loop, resulting in a denial‑of‑service condition. The weakness is a classic out‑of‑bounds read (CWE‑125).

The flaw resides in Zephyr RTOS’s ext2 filesystem implementation. Any instance of Zephyr that mounts an ext2 filesystem from media supplied by an attacker is susceptible. No vendor‑specific version data is supplied, so all affected releases of Zephyr that use the ext2 code path are potentially impacted.

The CVSS score of 4.9 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not actively exploited at the time of this analysis. An attacker must supply a crafted ext2 image and gain sufficient privilege to mount it in Zephyr, typically via physical or network access to the device. Consequently, the attack vector is local or remote depending on the ability to place the image on a device that will mount it, and the exploitation likelihood is low absent a privileged foothold.