Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-19576— Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是对该漏洞描述信息的中文翻译： Goodix GT9xx 输入驱动程序（位于 ）从控制器的状态寄存器读取触控点计数，并使用 （0x0F）进行掩码处理，从而得到一个 0..15 范围内的值。在 函数中，该值被直接用作填充 数组的循环上限。 是一个栈上数组，其大小由 定义，该 Kconfig 配置项的范围为 1..5，默认值为 1。除了依赖一条注释（声称控制器在初始化时被编程为报告不超过配置数量的触控点）外，没有其他检查来约束此计数。 每次循环迭代都会通过 I2C 读取八个字节，直接写入 。因此，如果控制器报告的触

CVSS 6.8 · Medium EPSS 0.17% · P6

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.0.0≤ 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19576

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count
Source: CVE Program / CVE List V5
Vulnerability Description
The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POINTS_MSK (0x0F), yielding a value of 0..15. In gt911_process() that value is used directly as the loop bound for filling point_reg[], a stack array sized to CONFIG_INPUT_GT911_MAX_TOUCH_POINTS, whose Kconfig range is 1..5 with a default of 1. No other check constrains the count; the driver relied only on a comment asserting that the controller had been programmed at init to report no more points than configured. Each loop iteration issues an I2C read of eight bytes straight into point_reg[i], so a controller that reports more points than the array holds causes up to 112 bytes of peer-supplied data to be written past the end of the array, over the stack frame of gt911_process() in the system workqueue thread. Two further loops then read out of bounds from the same array. Triggering it requires control of, or the ability to substitute, the I2C touch controller — plausible on the many supported boards where the GT9xx panel is a pluggable display module or shield rather than an on-PCB part; a spoofed device need only answer the init probes with a supported product ID and a checksum-valid config blob. The same overflow can also occur non-adversarially, with a GT9271-class panel that ignores the driver's touch-count programming and reports up to ten points, or with bus corruption of the single status byte. The impact is an out-of-bounds stack write with fully attacker-chosen content executing at kernel privilege, i.e. potential control-flow hijack on the host MCU, in addition to out-of-bounds reads and crashes. The attack vector is physical/local hardware access only; there is no network, USB, or syscall path to the defect. The fix clamps the reported count with min() against CONFIG_INPUT_GT911_MAX_TOUCH_POINTS before any array indexing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.0.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-19576

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19576

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-19576 (1)

Vendor Advisories for CVE-2026-19576 (1)

Same Patch Batch · zephyrproject · 2026-10-11 · 11 CVEs total

CVE-2026-19736 7.8 HIGH Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request leng
CVE-2026-19669 7.8 HIGH Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overfl
CVE-2026-19935 7.5 HIGH Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item i
CVE-2026-19577 7.1 HIGH Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer ad
CVE-2026-19740 6.5 MEDIUM Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update p
CVE-2026-19738 6.5 MEDIUM Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedure
CVE-2026-19739 6.5 MEDIUM Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives
CVE-2026-19737 5.5 MEDIUM NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
CVE-2026-19735 4.8 MEDIUM Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails sil
CVE-2026-18418 3.4 LOW Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's chan

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-787

V. Comments for CVE-2026-19576

No comments yet

Leave a comment