What is CVE-2026-10684?
CVE-2026-10684 is an out-of-bounds read vulnerability in Zephyr RTOS's `print_coredump_hdr()` function within the coredump subsystem, caused by using an unchecked 16-bit `tgt_code` field as an index into a fixed-size array. Processing a crafted coredump with a `tgt_code` >= 7 may lead to information disclosure. Users are advised to apply the security patch released by the Zephyr project.
Azərbaycanca: CVE-2026-10684 Zephyr RTOS-un `subsys/debug/coredump` modulunda `print_coredump_hdr()` funksiyasında 16-bitlik `tgt_code` sahəsinin yoxlanılmadan massiv indeksi kimi istifadəsi nəticəsində yaranan həddən kənar oxuma (out-of-bounds read) zəifliyidir. Bu, xüsusi hazırlanmış zədələnmiş yaddaş görüntüsü (coredump) işlənərkən məlumat sızmasına səbəb ola bilər. İstifadəçilərə Zephyr layihəsinin təqdim edəcəyi təhlükəsizlik yamasını tətbiq etmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-125
FAQ2
In which function of Zephyr RTOS does the CVE-2026-10684 out-of-bounds read vulnerability occur?
The vulnerability occurs in the `print_coredump_hdr()` function within the `subsys/debug/coredump` module.
How can an attacker exploiting CVE-2026-10684 cause information disclosure?
By processing a specially crafted corrupted coredump that contains an unchecked `tgt_code` field, leading to an out-of-bounds read and potential information disclosure.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.