In Zephyr versions 4.2.0 through 4.4.0, the function print_coredump_hdr() in subsys/debug/coredump/coredump_shell.c uses the 16-bit tgt_code field from a stored coredump header directly as an index into a fixed-size 7-element array (coredump_target_code2str[]) without bounds checking. If tgt_code is 7 or greater, this causes an out-of-bounds read of a char* pointer, which is then passed to shell_print as a %s argument. This leads to either disclosure of device memory contents or a crash if the pointer is invalid. The vulnerability is reachable only via the coredump print shell command and requires local shell access plus the ability to corrupt or stage the stored coredump. The issue was introduced in version 4.2.0 and fixed by clamping out-of-range tgt_code values to the 'unknown' entry at index 0.

An attacker with local shell access and the ability to stage or corrupt stored coredumps can cause an out-of-bounds read, potentially disclosing device memory contents or causing a crash. The impact is limited to local users with elevated privileges and requires specific conditions to trigger. The CVSS score is 3.0 (low severity), reflecting limited confidentiality impact and the need for high privileges and complex conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed by clamping out-of-range tgt_code values to a safe index in versions after 4.4.0. Until an official fix is confirmed, avoid exposing local shell access to untrusted users and prevent manipulation or corruption of stored coredumps.