CVE-2026-10684

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10684
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10684.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10684
Aliases
  • GHSA-9fw2-4429-49q8
Published
2026-07-29T18:03:08.771Z
Modified
2026-07-30T04:03:35.883460391Z
Severity
  • 3.0 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
Out-of-bounds read in coredump shell when printing stored-dump target code
Details

In subsys/debug/coredump/coredumpshell.c, printcoredumphdr() used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str[], a fixed 7-element array of string pointers, with no bounds check.

A stored coredump whose tgtcode is >= 7 causes an out-of-bounds read of a char* up to ~64K entries past the array; that value is passed as the %s argument to shellprint, which dereferences and walks it as a string. The result is either disclosure of device memory contents to the shell user or a crash when the out-of-bounds pointer is unmapped.

The defect is reached via the coredump print shell command (cmdcoredumpprintstoreddump -> prettyprintcoredump -> parseandprintcoredump -> printcoredumphdr). The tgtcode field is device-generated and in-range during normal crash handling, so triggering requires local shell access plus the ability to stage or corrupt the stored coredump in the flash/in-memory backend.

Introduced in v4.2.0 (commit 13abd7fe730) and present through v4.4.0; fixed by clamping out-of-range codes to the 'unknown' (index 0) entry.

Database specific 
{
    "cna_assigner": "zephyr",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10684.json",
    "cwe_ids": [
        "CWE-125"
    ]
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
413b789deb391d3a37d06b463288a5fe765ee57e
Fixed
75f67d766726351b30199f9a2bf55803d717a3be
Introduced
684c9e8f32e4373a21098559f748f06915f950c9
Last affected
1f6485eca25431b5ff27ce9a754218c9e559bbbb
Database specific 
{
    "extracted_events": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.3.1"
        },
        {
            "introduced": "4.4.0"
        },
        {
            "last_affected": "4.4.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v4.*
v4.2.0
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.3.1-rc1
v4.4.0
v4.4.1
v4.4.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10684.json"