CVE-2026-10684: Zephyr RTOS Information Disclosure Flaw

CVE-2026-10684 Overview

CVE-2026-10684 is an out-of-bounds read vulnerability [CWE-125] in the Zephyr real-time operating system (RTOS). The flaw resides in subsys/debug/coredump/coredump_shell.c, where print_coredump_hdr() uses the 16-bit tgt_code field from a stored coredump header as an unchecked index into coredump_target_code2str[], a fixed 7-element array of string pointers. A stored coredump with a tgt_code value greater than or equal to 7 triggers an out-of-bounds read that shell_print then dereferences as a %s argument. The result is either memory disclosure to the shell user or a crash when the pointer references unmapped memory.

Critical Impact
Local shell users able to stage a malformed coredump can read device memory contents or crash the shell process on affected Zephyr targets.

Affected Products

Zephyr RTOS v4.2.0 (introduced by commit 13abd7fe730)
Zephyr RTOS versions through v4.4.0
Devices exposing the coredump shell command with a stored-coredump backend

Discovery Timeline

2026-07-29 - CVE-2026-10684 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-10684

Vulnerability Analysis

The vulnerability is reached through the shell command chain cmd_coredump_print_stored_dump → pretty_print_coredump → parse_and_print_coredump → print_coredump_hdr. Inside print_coredump_hdr(), the code converts hdr->tgt_code from little-endian and directly indexes coredump_target_code2str[], a fixed 7-element table of target-name strings.

Because tgt_code is a 16-bit field, an attacker-controlled value can point up to roughly 64K entries past the end of the table. The resulting char* is passed to shell_print with %s, causing the shell to walk arbitrary memory as a null-terminated string and print its contents.

Exploitation requires local shell access plus the ability to stage or corrupt a stored coredump in the flash or in-memory backend. During normal crash handling the field is device-generated and always in range, so triggering the bug requires tampering with stored coredump data.

Root Cause

The root cause is missing bounds validation on untrusted data read from a stored coredump. The developer assumed tgt_code would always fall within the array size because it is populated by trusted crash-handling code, but did not enforce that invariant when parsing stored dumps.

Attack Vector

The attack vector is local and requires high privileges (shell access) plus the ability to write to the coredump storage backend. An attacker stages a crafted coredump header with tgt_code >= 7, then invokes the coredump print shell command to trigger the out-of-bounds read. Impact is limited to information disclosure of adjacent memory pointers or a crash of the shell context.

 static int print_coredump_hdr(const struct shell *sh, uint8_t *buf)
 {
 	struct coredump_hdr_t *hdr = (struct coredump_hdr_t *)buf;
+	uint16_t tgt_code_idx;
 
 	if (memcmp(hdr->id, "ZE", sizeof(char)*2) != 0) {
 		shell_print(sh, "Not a Zephyr coredump header");
 		return -EINVAL;
 	}
 
+	tgt_code_idx = sys_le16_to_cpu(hdr->tgt_code);
+	if (tgt_code_idx >= ARRAY_SIZE(coredump_target_code2str)) {
+		/* If out of bound, treat this as unknown (index 0). */
+		tgt_code_idx = 0U;
+	}
+
 	shell_print(sh, "**** Zephyr Coredump ****");
 	shell_print(sh, "\tVersion %u", hdr->hdr_version);
-	shell_print(sh, "\tTarget: %s",
-		    coredump_target_code2str[sys_le16_to_cpu(
-				    hdr->tgt_code)]);
+	shell_print(sh, "\tTarget: %s", coredump_target_code2str[tgt_code_idx]);

Source: Zephyr commit a9226324e8bd1f8adecafb1b6e0603f781dc750c — the patch clamps out-of-range values to index 0 ("unknown") before dereferencing the string table.

Detection Methods for CVE-2026-10684

Indicators of Compromise

Zephyr coredump shell output containing garbled, non-ASCII, or unexpectedly long target-name strings following the Target: field.
Unexpected shell crashes or device resets immediately after issuing coredump print against a stored dump.
Stored coredump headers whose tgt_code field decodes to a value greater than or equal to 7.

Detection Strategies

Inspect coredump storage backends (flash partitions or RAM regions) offline and validate that tgt_code in each coredump_hdr_t falls within the range 0–6.
Audit build configurations for CONFIG_DEBUG_COREDUMP and CONFIG_DEBUG_COREDUMP_SHELL; production images should generally disable shell-based coredump inspection.
Review Zephyr source trees pinned between commit 13abd7fe730 and the fix at commit a9226324e8bd1f8adecafb1b6e0603f781dc750c.

Monitoring Recommendations

Log all invocations of the coredump shell command and correlate with recent writes to coredump storage.
Monitor device telemetry for shell process crashes or watchdog resets that follow coredump read operations.
Track deployed Zephyr versions across your device fleet to identify units running v4.2.0 through v4.4.0.

How to Mitigate CVE-2026-10684

Immediate Actions Required

Update Zephyr to a version that includes commit a9226324e8bd1f8adecafb1b6e0603f781dc750c and rebuild affected firmware images.
Restrict shell access on production devices to trusted operators only, and remove default or shared credentials protecting the shell.
Disable CONFIG_DEBUG_COREDUMP_SHELL in production builds where coredump inspection over the shell is not required.

Patch Information

The fix is available in the upstream Zephyr project via commit a9226324e8bd1f8adecafb1b6e0603f781dc750c. The patch clamps out-of-range tgt_code values to index 0 (the "unknown" entry) before indexing coredump_target_code2str[]. Details are documented in the Zephyr GitHub Security Advisory GHSA-9fw2-4429-49q8.

Workarounds

Remove or disable the coredump shell command in Kconfig by unsetting CONFIG_DEBUG_COREDUMP_SHELL until firmware can be updated.
Protect coredump storage regions (flash partitions or in-memory backends) from write access by non-privileged code paths.
Enforce integrity checks or signatures on stored coredumps before they can be parsed by parse_and_print_coredump.

bash

# Disable the vulnerable shell command in prj.conf
CONFIG_DEBUG_COREDUMP=n
CONFIG_DEBUG_COREDUMP_SHELL=n