Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-13478— Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count

Quick assessment

Affected

zephyrproject zephyr

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

zephyrproject Zephyr是zephyrproject组织开源的一款面向物联网设备的实时操作系统。 zephyrproject Zephyr 3.5.0版本至4.4.2之前版本存在缓冲区错误漏洞，该漏洞源于ext2文件系统驱动程序在验证磁盘块位图时未对超级块中的块计数进行边界检查，导致越界读取，可能造成系统崩溃，导致拒绝服务。

CVSS 5.5 · Medium EPSS 0.14% · P4 Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1083 · File and Directory Discovery

Affected Version Matrix 1

Vendor	Product	Version Range	Status
zephyrproject	zephyr	`3.5.0< 4.4.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-13478

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count

Source: CVE Program / CVE List V5

Vulnerability Description

The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_first_data_block to ext2_bitmap_count_set(). That helper (subsys/fs/ext2/ext2_bitmap.c) treats its argument as a number of bits and reads one bitmap byte per eight bits, but the bitmap buffer (BGROUP_BLOCK_BITMAP) is a single fetched block of only fs->block_size bytes (capacity fs->block_size * 8 bits). s_blocks_count and s_first_data_block are taken verbatim from the superblock and were never bounded against this single-group capacity; ext2_verify_disk_superblock() checks the magic, revision, and block-size shift but not the block count. A crafted ext2 image with an oversized s_blocks_count (up to ~4 billion, against a maximum 4096-byte block / 32768-bit bitmap) makes ext2_bitmap_count_set() scan roughly 512 MB of memory past the bitmap block — a large out-of-bounds read of the static block slab and adjacent memory. The defect is reached during mount: ext2_init_fs() is invoked from ext2_mount() (subsys/fs/ext2/ext2_ops.c), the registered .mount operation. Any path that mounts an attacker-supplied ext2 image (removable media, a disk/flash partition, or a downloaded image) triggers it. The kernel-privileged parser operates on attacker-controlled data, so the bug is exploitable wherever untrusted ext2 media can be mounted. Impact is an out-of-bounds read only: the resulting bit count is compared internally and the mount is rejected, so no attacker-controlled bytes are returned (not a useful information leak). The ~512 MB over-read will almost certainly cross an unmapped or MPU-protected boundary and fault, crashing the system — a denial of service triggered by mounting a single malformed image. The fix rejects any image whose fs_blocks exceeds fs->block_size * 8 before the scan.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Vulnerability Title

zephyrproject Zephyr 缓冲区错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
zephyrproject	zephyr	3.5.0 ~ 4.3.2	-

II. Public POCs for CVE-2026-13478

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-13478

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-13478 (1)

🔗 fs: ext2: reject s_blocks_count exceeding single-group bitmap capacity · zephyrproject-rtos/zephyr@9c0f869 · GitHub patch

Vendor Advisories for CVE-2026-13478 (1)

🔗 Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count · Advisory · zephyrproject-rtos/zephyr · GitHub Read full article

https://www.cve.org/CVERecord?id=CVE-2026-13478

Same Patch Batch · zephyrproject · 2026-08-25 · 5 CVEs total

CVE-2026-13214	9.8 CRITICAL	Stack buffer overflow in OCPP GetConfiguration key parsing
CVE-2026-13215	6.8 MEDIUM	Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a cra
CVE-2026-13216	6.1 MEDIUM	Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied cap
CVE-2026-13217	5.9 MEDIUM	NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi

IV. Related Vulnerabilities

Same product: zephyr

Same vendor: zephyrproject

Same weakness: CWE-125