Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-14986— Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ITE it51xxx I2C 驱动在作为 I2C 从机（target）且启用缓冲区模式（CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE）时，在其目标 FIFO 中断处理函数 （位于 ）中，会将主机提供的写入数据复制到固定大小的 中。该复制循环向 写入数据，并且只有在写入完成后才检查 是否超出 ，因此该边界检查无法防止缓冲区溢出。 运行索引 会在每次正在进行的传输中的 FIFO 填充中断中累加 个字节，并仅在遇到 STOP 条件或超时情况时重置为零。如果 I2C

CVSS 6.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14986

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction
Source: CVE Program / CVE List V5
Vulnerability Description
The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data->w_index] and only checks data->w_index against sizeof(data->target_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow. The running index data->w_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data->w_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->target_out_buffer and following static device data. The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.2.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-14986

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14986

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-14986 (1)

Vendor Advisories for CVE-2026-14986 (1)

Same Patch Batch · zephyrproject · 2026-09-14 · 6 CVEs total

CVE-2026-16147 6.8 MEDIUM it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-f
CVE-2026-15893 6.5 MEDIUM Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement cause
CVE-2026-15924 5.9 MEDIUM Use-after-free / double-free from unsynchronized concurrent access to the TLS client sessi
CVE-2026-15923 4.6 MEDIUM Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_
CVE-2026-16148 4.6 MEDIUM Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy d

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-787

V. Comments for CVE-2026-14986

No comments yet

Leave a comment