{"id":"CVE-2026-14986","summary":"Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction","details":"The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data-\u003etarget_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data-\u003ew_index] and only checks data-\u003ew_index against sizeof(data-\u003etarget_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow.\n\nThe running index data-\u003ew_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data-\u003ew_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data-\u003etarget_out_buffer and following static device data.\n\nThe trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store.","aliases":["GHSA-jmjj-w736-fw2j"],"modified":"2026-09-16T08:11:33.416318Z","published":"2026-09-14T22:07:46.392Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14986.json","cna_assigner":"zephyr","cwe_ids":["CWE-787"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14986.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jmjj-w736-fw2j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14986"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/eac92173cf13bba4e6c6eea3460ee6085513d86d"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"413b789deb391d3a37d06b463288a5fe765ee57e"},{"fixed":"eac92173cf13bba4e6c6eea3460ee6085513d86d"}],"database_specific":{"extracted_events":[{"introduced":"4.2.0"},{"fixed":"4.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14986.json","vanir_signatures_modified":"2026-09-16T08:11:33Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["321671445671022341232420115123652804310","283132513376500006200909516415348555875","331088447680437939116471602247957810514","71616046121915797441327681874449963383","339202917471100539814980998497889205721","326053372248794752281863958952115416760","275942000374285774165642909343768461576","201410142959219444891871196483720933617","86066141892708135247313079246255573325","171762320012972550674667489679238867312","312376472708099061592943628115000208578","277783410771265040233600531341455660806","98746703942509715375635755539289577108","272666629882320260848470560623438219641","323383734963690534640156967545218712780","241083646531394199347725137968739349909","338801617119355943222728732047970311745","60690795004510150987787044179439481766","84427367876994294911976846126748243569","330389579219567403306653467826600797782","257230557521598503815656902778873304414","66108174124905630907408503687644472142","74463179373123933535672015473125343126","57734136262911605194920055958115076021","68232274568406620485512144236843177483","66994343641873641952175262481708470720","94145959406214202334310833306916152555","309190609909774986953155562039574834594","188416385349896953737217647445996403232","233142398201713001040982548482943440076","246239981480201947312892151896667155587","160843926625565387062322796299263380422","121000005131184665459126114664809047779","224356974912399438495764614980289634002","272117231170843051840957973371659463945","31253413153969462620658285593150758196","94423162084271475728003557632035605323","323876067513223384671234304476833489042","58305348866551578943435264025126594017","321094697697166372745498726092549399497","117935129122569763275903609309440346560","100524990762455046101300292571921772454","316750396456186236765286317734161419279","333396536601184305080046612880142019942","134745136836750077695517917879241336603","161170324232831059782510608797520434699","293105376182811256635701072827286197200","4918208568902238202377122502705109483","107953137117035252365970446744108838077","172177523639853454367600044156241285225","265142387262806740284116102743881408742","176068201908201876247205786334348599228","187982608454318567268951697586272018388","337111074927827251769491134172682482982","17396460185770035380926216870172882481","188416385349896953737217647445996403232","233142398201713001040982548482943440076","246239981480201947312892151896667155587","160843926625565387062322796299263380422","121000005131184665459126114664809047779","224356974912399438495764614980289634002","272117231170843051840957973371659463945","31253413153969462620658285593150758196","94423162084271475728003557632035605323","323876067513223384671234304476833489042","58305348866551578943435264025126594017","219046417890029008120308477718104596971","177187197577464626435780613634088702393","22762038668452026537065297719514868490","88962211884873117199137069041975238028","28040101621193368894771127669275369280","337706920333342867257117700705351735616","62098108439594666100640387835593535555","62000290162504636825681730609938433300","49528416871336289713523101584625582521","223816381391638124728414457599275468533","256497543029383416024967819340808083244","303370407940840427266579065108427320049","128534283643614800539418445095298835996","242322707007905233386996521393688184588","270000920328207078271001253295225843815","118657741452347721746123760155122572570","73879428419316955824742180626789631900","142564854278817363866528061103963806082","53027909489329032489976876840130704517","9291018426330907680353431703041470721","56334649157540970739987488477693912411"],"threshold":0.9},"id":"CVE-2026-14986-40a7b5b4","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/eac92173cf13bba4e6c6eea3460ee6085513d86d","target":{"file":"drivers/i2c/i2c_ite_it51xxx.c"}},{"deprecated":false,"digest":{"function_hash":"266430166747272757782700960099366641059","length":3013},"id":"CVE-2026-14986-da8b2118","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/eac92173cf13bba4e6c6eea3460ee6085513d86d","target":{"file":"drivers/i2c/i2c_ite_it51xxx.c","function":"target_i2c_isr_fifo"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}