CVE-2026-14986: ITE it51xxx I2C Driver Buffer Overflow

CVE-2026-14986 Overview

CVE-2026-14986 is an out-of-bounds write vulnerability [CWE-787] in the Zephyr RTOS ITE it51xxx I2C driver. When the driver operates as an I2C target in buffer mode (CONFIG_I2C_TARGET combined with CONFIG_I2C_TARGET_BUFFER_MODE), a missing pre-write bounds check in the FIFO interrupt handler allows a malicious I2C master on the same bus to overflow the fixed-size data->target_in_buffer. The overflow can corrupt adjacent static device data, crash the controller, or be shaped toward code execution in the target's kernel or firmware context.

Critical Impact
A rogue or compromised I2C master on the shared bus can trigger memory corruption in the Zephyr firmware without any software privilege on the victim device, potentially leading to denial of service or arbitrary code execution.

Affected Products

Zephyr RTOS with drivers/i2c/i2c_ite_it51xxx.c compiled as I2C target
Configurations enabling CONFIG_I2C_TARGET and CONFIG_I2C_TARGET_BUFFER_MODE
ITE it51xxx embedded controller platforms using the default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE of 256 bytes

Discovery Timeline

2026-09-14 - CVE-2026-14986 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-14986

Vulnerability Analysis

The flaw resides in target_i2c_isr_fifo(), the target FIFO interrupt handler in drivers/i2c/i2c_ite_it51xxx.c. The handler copies host-supplied write bytes into data->target_in_buffer[i + data->w_index] and only compares data->w_index against sizeof(data->target_in_buffer) after the store has already executed. The bounds check therefore runs too late to stop the overflow.

The index data->w_index accumulates across every FIFO-fill interrupt for a single ongoing transaction. It resets to zero only on an I2C STOP condition or a timeout. A single sustained write transaction longer than the buffer drives the index past the end of target_in_buffer and into adjacent static device data such as target_out_buffer.

Root Cause

The root cause is an ordering error in the buffer bounds check. The driver validates the write index after the memory store, violating the standard pattern of check-then-write. Because both the written values and the overflow length are attacker-controlled, the primitive is a fully-controlled out-of-bounds write into predictable adjacent structures.

Attack Vector

Exploitation requires an attacker-controlled I2C master on the same physical bus as the vulnerable Zephyr target. Suitable positions include a compromised application processor, a rogue peripheral on an exposed I2C header, or hardware implants on unshielded bus traces. No software privilege on the victim device is required, and the handler executes in the target's kernel or firmware context.

text

// Patch excerpt: drivers/i2c/Kconfig.it51xxx
 config I2C_TARGET_IT51XXX_MAX_BUF_SIZE
-	int "It is allowed to configure the dedicated FIFO size up to 256 bytes."
+	int "I2C target driver buffer size"
 	default 256
+	range 32 2048
+	help
+	  Size of the buffer used by the I2C target driver, used to accumulate
+	  data across multiple FIFO transfers.

Source: Zephyr commit eac92173cf13. The upstream fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts the transfer and resets the FIFO before any out-of-bounds store occurs.

Detection Methods for CVE-2026-14986

Indicators of Compromise

Unexpected resets, watchdog trips, or hard faults on Zephyr-based embedded controllers that expose I2C target endpoints
I2C target logs showing single write transactions exceeding the configured CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE value
Corrupted values in target_out_buffer or adjacent driver state observed during firmware debugging

Detection Strategies

Enable Zephyr I2C driver logging and instrument target_i2c_isr_fifo() to record transactions where w_index approaches or exceeds the buffer size
Use a bus analyzer to capture I2C traffic and flag write bursts longer than the target's declared buffer capacity
Add build-time assertions or runtime sanity checks on w_index to detect anomalous accumulation across FIFO interrupts

Monitoring Recommendations

Monitor firmware crash telemetry and coredumps from fleets running Zephyr on ITE it51xxx platforms for signatures consistent with static-data corruption
Track I2C bus error rates, STOP-condition anomalies, and unexpected timeouts that correlate with oversized target writes
Correlate host-side application processor activity with target-side resets to identify potentially compromised masters on shared buses

How to Mitigate CVE-2026-14986

Immediate Actions Required

Apply the upstream Zephyr patch that introduces the pre-write bounds check in target_i2c_fifo_read_to_buf()
Audit firmware builds for enabled CONFIG_I2C_TARGET and CONFIG_I2C_TARGET_BUFFER_MODE combinations on ITE it51xxx hardware
Inventory devices that expose I2C target interfaces to untrusted masters or externally accessible connectors

Patch Information

The fix is delivered in Zephyr commit eac92173cf13bba4e6c6eea3460ee6085513d86d. Additional context and coordinated disclosure details are available in the Zephyr Security Advisory GHSA-jmjj-w736-fw2j. Rebuild affected firmware images against a patched Zephyr tree and redeploy to all impacted embedded controllers.

Workarounds

Disable CONFIG_I2C_TARGET_BUFFER_MODE on ITE it51xxx devices where target buffer mode is not strictly required
Restrict physical access to I2C buses and remove or shield exposed debug or expansion headers that carry the bus
Ensure only trusted masters share the I2C bus with the Zephyr target and validate the integrity of any application processor acting as master

bash

# Example: disable I2C target buffer mode in Zephyr prj.conf
CONFIG_I2C_TARGET=n
CONFIG_I2C_TARGET_BUFFER_MODE=n
# Or, if target mode is required, tune buffer size within the patched range
CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE=256