CVE-2026-14986

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14986
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14986.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14986
Aliases
  • GHSA-jmjj-w736-fw2j
Published
2026-09-14T22:07:46Z
Modified
2026-09-16T08:11:33Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction
Details

The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data->w_index] and only checks data->w_index against sizeof(data->target_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow.

The running index data->w_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data->w_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->target_out_buffer and following static device data.

The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store.

Database specific 
{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14986.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
413b789deb391d3a37d06b463288a5fe765ee57e
Fixed
eac92173cf13bba4e6c6eea3460ee6085513d86d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v4.*
v4.2.0
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14986.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "321671445671022341232420115123652804310",
                "283132513376500006200909516415348555875",
                "331088447680437939116471602247957810514",
                "71616046121915797441327681874449963383",
                "339202917471100539814980998497889205721",
                "326053372248794752281863958952115416760",
                "275942000374285774165642909343768461576",
                "201410142959219444891871196483720933617",
                "86066141892708135247313079246255573325",
                "171762320012972550674667489679238867312",
                "312376472708099061592943628115000208578",
                "277783410771265040233600531341455660806",
                "98746703942509715375635755539289577108",
                "272666629882320260848470560623438219641",
                "323383734963690534640156967545218712780",
                "241083646531394199347725137968739349909",
                "338801617119355943222728732047970311745",
                "60690795004510150987787044179439481766",
                "84427367876994294911976846126748243569",
                "330389579219567403306653467826600797782",
                "257230557521598503815656902778873304414",
                "66108174124905630907408503687644472142",
                "74463179373123933535672015473125343126",
                "57734136262911605194920055958115076021",
                "68232274568406620485512144236843177483",
                "66994343641873641952175262481708470720",
                "94145959406214202334310833306916152555",
                "309190609909774986953155562039574834594",
                "188416385349896953737217647445996403232",
                "233142398201713001040982548482943440076",
                "246239981480201947312892151896667155587",
                "160843926625565387062322796299263380422",
                "121000005131184665459126114664809047779",
                "224356974912399438495764614980289634002",
                "272117231170843051840957973371659463945",
                "31253413153969462620658285593150758196",
                "94423162084271475728003557632035605323",
                "323876067513223384671234304476833489042",
                "58305348866551578943435264025126594017",
                "321094697697166372745498726092549399497",
                "117935129122569763275903609309440346560",
                "100524990762455046101300292571921772454",
                "316750396456186236765286317734161419279",
                "333396536601184305080046612880142019942",
                "134745136836750077695517917879241336603",
                "161170324232831059782510608797520434699",
                "293105376182811256635701072827286197200",
                "4918208568902238202377122502705109483",
                "107953137117035252365970446744108838077",
                "172177523639853454367600044156241285225",
                "265142387262806740284116102743881408742",
                "176068201908201876247205786334348599228",
                "187982608454318567268951697586272018388",
                "337111074927827251769491134172682482982",
                "17396460185770035380926216870172882481",
                "188416385349896953737217647445996403232",
                "233142398201713001040982548482943440076",
                "246239981480201947312892151896667155587",
                "160843926625565387062322796299263380422",
                "121000005131184665459126114664809047779",
                "224356974912399438495764614980289634002",
                "272117231170843051840957973371659463945",
                "31253413153969462620658285593150758196",
                "94423162084271475728003557632035605323",
                "323876067513223384671234304476833489042",
                "58305348866551578943435264025126594017",
                "219046417890029008120308477718104596971",
                "177187197577464626435780613634088702393",
                "22762038668452026537065297719514868490",
                "88962211884873117199137069041975238028",
                "28040101621193368894771127669275369280",
                "337706920333342867257117700705351735616",
                "62098108439594666100640387835593535555",
                "62000290162504636825681730609938433300",
                "49528416871336289713523101584625582521",
                "223816381391638124728414457599275468533",
                "256497543029383416024967819340808083244",
                "303370407940840427266579065108427320049",
                "128534283643614800539418445095298835996",
                "242322707007905233386996521393688184588",
                "270000920328207078271001253295225843815",
                "118657741452347721746123760155122572570",
                "73879428419316955824742180626789631900",
                "142564854278817363866528061103963806082",
                "53027909489329032489976876840130704517",
                "9291018426330907680353431703041470721",
                "56334649157540970739987488477693912411"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-14986-40a7b5b4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/eac92173cf13bba4e6c6eea3460ee6085513d86d",
        "target": {
            "file": "drivers/i2c/i2c_ite_it51xxx.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "266430166747272757782700960099366641059",
            "length": 3013
        },
        "id": "CVE-2026-14986-da8b2118",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/eac92173cf13bba4e6c6eea3460ee6085513d86d",
        "target": {
            "file": "drivers/i2c/i2c_ite_it51xxx.c",
            "function": "target_i2c_isr_fifo"
        }
    }
]
vanir_signatures_modified 
"2026-09-16T08:11:33Z"