Description
In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header directly as an index into coredump_target_code2str[], a fixed 7-element array of string pointers, with no bounds check.

A stored coredump whose tgt_code is >= 7 causes an out-of-bounds read of a char* up to ~64K entries past the array; that value is passed as the %s argument to shell_print, which dereferences and walks it as a string. The result is either disclosure of device memory contents to the shell user or a crash when the out-of-bounds pointer is unmapped.

The defect is reached via the coredump print shell command (cmd_coredump_print_stored_dump -> pretty_print_coredump -> parse_and_print_coredump -> print_coredump_hdr). The tgt_code field is device-generated and in-range during normal crash handling, so triggering requires local shell access plus the ability to stage or corrupt the stored coredump in the flash/in-memory backend.

Introduced in v4.2.0 (commit 13abd7fe730) and present through v4.4.0; fixed by clamping out-of-range codes to the 'unknown' (index 0) entry.
Published: 2026-07-29
Score: 3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An out-of-bounds read in the coredump shell command occurs when the 16-bit target code field of a stored Zephyr core dump header is used as an array index without bounds checking. The vulnerability can read a pointer beyond a seven-element array and then use that pointer as a string argument, leading to either disclosure of arbitrary device memory to the shell user or a crash if the pointer is unmapped. This flaw is classified as CWE-125.

Affected Systems

The flaw exists in Zephyr project installations from version 4.2.0 up to and including 4.4.0. It is present in the subsys/debug/coredump component and was introduced in the commit a9226324e8bd1f8adecafb1b6e0603f781dc750c. The defect is fixed in newer releases by clamping any out-of-range codes to the 'unknown' entry (index 0).

Risk and Exploitability

The CVSS base score of 3 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability requires local shell access and the ability to stage or corrupt a stored core dump in flash or memory. It is not listed in the CISA KEV catalog. Under these conditions, the risk is limited to devices where an attacker can gain local shell privileges and manipulate core dumps, potentially exposing memory or causing a system crash.

Generated by OpenCVE AI on August 3, 2026 at 13:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a version that includes the fix for the out-of-bounds read in coredump shell printing.
  • If an upgrade is not immediately possible, restrict local shell access or disable the coredump print command in the production environment.
  • Ensure that stored core dumps are protected or regularly cleared so that an attacker cannot alter the target code field.

Generated by OpenCVE AI on August 3, 2026 at 13:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Wed, 29 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump header directly as an index into coredump_target_code2str[], a fixed 7-element array of string pointers, with no bounds check. A stored coredump whose tgt_code is >= 7 causes an out-of-bounds read of a char* up to ~64K entries past the array; that value is passed as the %s argument to shell_print, which dereferences and walks it as a string. The result is either disclosure of device memory contents to the shell user or a crash when the out-of-bounds pointer is unmapped. The defect is reached via the coredump print shell command (cmd_coredump_print_stored_dump -> pretty_print_coredump -> parse_and_print_coredump -> print_coredump_hdr). The tgt_code field is device-generated and in-range during normal crash handling, so triggering requires local shell access plus the ability to stage or corrupt the stored coredump in the flash/in-memory backend. Introduced in v4.2.0 (commit 13abd7fe730) and present through v4.4.0; fixed by clamping out-of-range codes to the 'unknown' (index 0) entry.
Title Out-of-bounds read in coredump shell when printing stored-dump target code
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-29T18:47:20.793Z

Reserved: 2026-06-02T15:26:21.656Z

Link: CVE-2026-10684

cve-icon Vulnrichment

Updated: 2026-07-29T18:47:16.699Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-29T19:16:43.677

Modified: 2026-07-30T14:19:24.857

Link: CVE-2026-10684

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T13:15:05Z

Weaknesses