The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte without validating the order or ensuring the receive buffer is allocated before use. Specifically, the MCTP_I2C_GPIO_RX_MSG_ADDR handler writes through a potentially NULL or unallocated buffer pointer if the length register is not sent before the data register, causing memory corruption or a hard fault. Additionally, a one-byte heap overflow can occur when more than 255 data bytes are sent due to a write-then-check bounds test. Since the binding performs no authentication and accepts raw bytes from the bus master, a malicious or malfunctioning controller can exploit this without prior protocol state. The vulnerability affects Zephyr versions 4.3.0 and 4.4.0 and was fixed by deferring buffer allocation until the first data byte, rejecting zero-length packets, and moving bounds checks before writes.

An attacker controlling the I2C bus master can cause memory corruption or a hard fault on the target device running the vulnerable Zephyr versions. This can lead to denial of service or potentially other impacts due to heap overflow or NULL pointer dereference. The vulnerability does not require authentication or prior protocol state, increasing the attack surface on affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that defers buffer allocation until the first data byte, rejects zero-length packets, and moves bounds checks before writes. Until an official patch or update is available, restrict access to the I2C bus to trusted controllers to prevent malicious exploitation.