CVE-2026-10678 zephyrproject CVE debrief

Who should care

Users of Zephyr versions 4.3.0 and 4.4.0 who utilize the MCTP-over-I2C+GPIO target binding should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing system configurations, monitoring for suspicious I2C activity, and implementing compensating controls to detect and prevent exploitation.

Technical summary

The vulnerability is caused by the lack of validation for the order and receive buffer in the mctp_i2c_gpio_target_write_received() function. This allows an attacker to write an arbitrary byte through a NULL/unallocated mctp_pktbuf pointer, leading to memory corruption or a hard fault. Additionally, a one-byte heap overflow can occur when more than 255 data bytes are sent. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store.

Defensive priority

High

Recommended defensive actions

• Update to a fixed version of Zephyr
• Implement compensating controls to detect and prevent exploitation
• Monitor for suspicious activity on the I2C bus
• Review and update affected systems' configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. Evidence is limited to public statements from the vendor and CVE details. Defenders should verify system configurations, review logs for suspicious I2C activity, and monitor for potential memory corruption or denial of service. Additional verification tasks include checking relevant monitoring, detection, and logs for exposed assets that need extra review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.