CVE-2026-10644 zephyrproject CVE debrief

Who should care

Defenders responsible for Zephyr deployments using the PIC32CM-JH SoC family should assess their exposure to this vulnerability, especially if they are using async UART configuration with one-byte buffers. They should verify their system's configuration and consider updating to version 4.4.2 or later.

Why it matters

The CVE-2026-10644 vulnerability in the Microchip SERCOM-G1 UART driver used by the Zephyr project requires defenders to verify their async UART configuration and buffer sizes, especially for versions between 4.4.0 and 4.4.2, to prevent potential crashes or denial of service.

• Possible crash or denial of service due to single-byte memory corruption
• Need to verify async UART configuration and buffer sizes in deployments
• Potential for adjacent attackers to exploit the vulnerability

Technical summary

The Microchip SERCOM-G1 UART driver, used by the PIC32CM-JH SoC family in the Zephyr project, contains an out-of-bounds write in its asynchronous receive path. This issue occurs when a one-byte receive buffer is used with the async UART configuration enabled. The defect was introduced in version 4.4.0 and has been fixed in version 4.4.2. The impact is limited to single-byte memory corruption adjacent to the RX buffer, which could lead to a crash or denial of service. Defenders should prioritize verifying the async UART configuration and buffer sizes in their Zephyr deployments, especially for versions between 4.4.0 and 4.4.2. They should also review the system's exposure to potential UART RX data from adjacent

Defensive priority

Defenders should prioritize verifying the async UART configuration and buffer sizes in their Zephyr deployments, especially for versions between 4.4.0 and 4.4.2. They should also review the system's exposure to potential UART RX data from adjacent attackers.

Recommended defensive actions

• Verify async UART configuration and buffer sizes in Zephyr deployments
• Review system exposure to potential UART RX data from adjacent attackers
• Update to Zephyr version 4.4.2 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the out-of-bounds write vulnerability in the Microchip SERCOM-G1 UART driver. The fix for this issue is available in version 4.4.2 of the Zephyr project.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.