What is CVE-2026-10678?
This vulnerability exists in the MCTP-over-I2C+GPIO target binding of the Zephyr RTOS. Improper validation of pseudo-register writes from an I2C bus master in the `mctp_i2c_gpio_target_write_received()` function can lead to a buffer overflow. Immediate patching and restricting physical access to the I2C interface are required.
Azərbaycanca: Bu boşluq Zephyr əməliyyat sisteminin MCTP-over-I2C+GPIO hədəf bağlamasında aşkarlanıb. Təsdiqlənməmiş giriş məlumatları səbəbindən I2C bus master-dən gələn psevdo-registr yazıları düzgün işlənmir, bu isə yaddaş pozuntusuna yol aça bilər. Dərhal müvafiq yamaq tətbiq edilməli və cihazın I2C interfeysinə giriş məhdudlaşdırılmalıdır.
Related CVEs
link basis: same weakness class CWE-119; shared vendor: Zephyr
FAQ2
In which component of the Zephyr RTOS was CVE-2026-10678 found?
The vulnerability was found in the MCTP-over-I2C+GPIO target binding of the Zephyr RTOS.
What causes the CVE-2026-10678 vulnerability?
The vulnerability is caused by improper validation of pseudo-register writes from an I2C bus master.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.