CVE-2026-102730: High severity Eclipse Foundation LevelX vulnerability
Mounting an attacker-controlled NAND flash image (lxnandflashopen()) triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD 9f1cfdc. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.)
Affected Software
Event History
Frequently Asked Questions
What access or input control would an attacker need?
The attacker needs the ability to supply or cause the system to mount an attacker-controlled NAND flash image through lx_nand_flash_open().
Is the impact limited to a crash or memory disclosure?
No. The reported out-of-bounds heap write overwrites a driver function pointer in the control block, with demonstrated control-flow hijack and RIP set to a full attacker-chosen 8-byte value.
What build was the issue reproduced against?
It was reproduced under ASan at HEAD commit 9f1cfdc. The provided data does not identify a fixed version or affected release range.