CVE-2026-10664 is a memory safety vulnerability in the nRF70 Wi-Fi driver's power-save event handler function nrf_wifi_event_proc_get_power_save_info() within Zephyr OS releases through version 4.4.0. The function copies TWT flow entries from an event into a fixed-size array of 8 elements without validating the number of flows against the array size or the event length. If the event reports more than 8 flows, the handler writes beyond the bounds of the destination array, which is typically located on the caller's stack, causing an out-of-bounds write of approximately 40 bytes. The event is generated by the nRF70 co-processor firmware in response to a host-initiated power-save GET request, so exploitation requires the firmware to send a malformed or out-of-range event. The trust boundary is between the host and the trusted co-processor, not directly from a remote access point. The vulnerability is mitigated by rejecting events with num_twt_flows greater than WIFI_MAX_TWT_FLOWS or with event length shorter than expected, and by adding a null check on the caller buffer.

The vulnerability allows an out-of-bounds write on the stack of the caller, potentially leading to memory corruption affecting confidentiality, integrity, and availability. However, exploitation requires a malformed event from the trusted nRF70 co-processor firmware, limiting the attack surface. The CVSS 3.1 score is 5.0 (medium severity) reflecting the complexity and limited attack vector. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves rejecting events where the number of TWT flows exceeds the maximum allowed or where the event length is insufficient, and adding a null check on the caller buffer. Until an official patch is available, ensure that the nRF70 co-processor firmware is trusted and not compromised, as the vulnerability requires malformed events from this firmware.