CVE-2026-10684: Out-of-bounds read in coredump shell when printing stored-dump target code
In subsys/debug/coredump/coredumpshell.c, printcoredumphdr() used the 16-bit tgtcode field of a stored Zephyr coredump header directly as an index into coredumptargetcode2str[], a fixed 7-element array of string pointers, with no bounds check.
A stored coredump whose tgtcode is >= 7 causes an out-of-bounds read of a char up to ~64K entries past the array; that value is passed as the %s argument to shellprint, which dereferences and walks it as a string. The result is either disclosure of device memory contents to the shell user or a crash when the out-of-bounds pointer is unmapped.
The defect is reached via the coredump print shell command (cmdcoredumpprintstoreddump -> prettyprintcoredump -> parseandprintcoredump -> printcoredumphdr). The tgtcode field is device-generated and in-range during normal crash handling, so triggering requires local shell access plus the ability to stage or corrupt the stored coredump in the flash/in-memory backend.
Introduced in v4.2.0 (commit 13abd7fe730) and present through v4.4.0; fixed by clamping out-of-range codes to the 'unknown' (index 0) entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v4.4.0 - Configuration
In print_coredump_hdr(), when using the stored coredump header’s 16-bit tgt_code to index coredump_target_code2str[] (a fixed 7-element array), add a bounds check and clamp out-of-range codes to the 'unknown' entry (index 0) instead of indexing directly.
Zephyr coredump shell (subsys/debug/coredump/coredump_shell.c: print_coredump_hdr) tgt_code bounds handling for index into coredump_target_code2str[] = Clamp out-of-range tgt_code values to index 0 ('unknown')
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10684?
CVE-2026-10684 has a low severity rating of 3.
How do I fix CVE-2026-10684?
To fix CVE-2026-10684, ensure proper bounds checking is implemented when accessing the coredump_target_code2str array.
What type of vulnerability is CVE-2026-10684?
CVE-2026-10684 is classified as an out-of-bounds read vulnerability.
What software is affected by CVE-2026-10684?
The affected software for CVE-2026-10684 is the Zephyr operating system.
What can be exploited in CVE-2026-10684?
CVE-2026-10684 can be exploited by manipulating the tgt_code of a stored coredump to access invalid memory locations.