Description
The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive buffer was allocated: a controller that selects the data register and writes a byte without first sending the length register (which is what allocates the buffer) causes a write of an attacker-chosen byte through a NULL/unallocated mctp_pktbuf pointer (i.e. into a small attacker-advanceable offset above address 0), producing memory corruption or a hard fault.

The same handler also performs a write-then-check bounds test, allowing a one-byte heap overflow at data[255] when more than 255 data bytes are sent.

Because the I2C target callback is invoked with raw bytes supplied by whatever device is the bus master and the binding performs no authentication, a malicious or malfunctioning controller on the bus can trigger these without any prior protocol state, leading to memory corruption and/or denial of service on the target device.

The vulnerable code was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store.
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The MCTP-over-I2C+GPIO target binding in Zephyr contains a NULL pointer dereference and an out‑of‑bounds write that are triggered by arbitrary pseudo‑register writes over the I2C bus. The handler processes each byte without validating the order or ensuring that the receive buffer has been allocated, allowing a master device to write a byte to the data register before sending the length register. This writes through an uninitialized pointer and can corrupt memory or cause a hard fault. Additionally, if more than 255 data bytes are sent the bounds check occurs after the write, enabling a one‑byte overflow into the heap. The lack of authentication on the I2C target callback means any I2C master can trigger these faults without prior protocol state.

Affected Systems

Zephyr operating system from the Zephyr Project. Vulnerable in the branch that shipped the MCTP‑I2C+GPIO target binding, specifically in versions 4.3.0 and 4.4.0; the fix is included in later releases that defer allocation and adjust bounds checking.

Risk and Exploitability

The vulnerability has a CVSS score of 8.1 and an EPSS score of < 1 %, and it is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector is physical access to the I2C bus or control of an I2C master on the same bus, as the exploit requires no authentication. By sending crafted pseudo‑register writes, an attacker can trigger memory corruption or cause a denial of service, potentially compromising device integrity or availability.

Generated by OpenCVE AI on July 30, 2026 at 16:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Zephyr patch that defers allocation to the first data byte with a NULL check and performs bounds checks before the store (see commit 9e23364261a2188c171d734d6947e02ee2a9510f).
  • Upgrade the Zephyr kernel to a version that incorporates this patch (e.g., v4.5.0 or later).
  • Restrict or authenticate access to the I2C bus so that only trusted masters can issue writes to the MCTP I2C+GPIO target binding.

Generated by OpenCVE AI on July 30, 2026 at 16:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive buffer was allocated: a controller that selects the data register and writes a byte without first sending the length register (which is what allocates the buffer) causes a write of an attacker-chosen byte through a NULL/unallocated mctp_pktbuf pointer (i.e. into a small attacker-advanceable offset above address 0), producing memory corruption or a hard fault. The same handler also performs a write-then-check bounds test, allowing a one-byte heap overflow at data[255] when more than 255 data bytes are sent. Because the I2C target callback is invoked with raw bytes supplied by whatever device is the bus master and the binding performs no authentication, a malicious or malfunctioning controller on the bus can trigger these without any prior protocol state, leading to memory corruption and/or denial of service on the target device. The vulnerable code was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store.
Title NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller
Weaknesses CWE-476
CWE-787
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-22T19:36:46.774Z

Reserved: 2026-06-02T15:26:08.472Z

Link: CVE-2026-10678

cve-icon Vulnrichment

Updated: 2026-07-22T19:32:21.253Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:17:00.047

Modified: 2026-07-30T15:54:58.380

Link: CVE-2026-10678

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T16:15:04Z

Weaknesses