The ADC API in Zephyr requires drivers to reject sampling sequences if the destination buffer is too small. The ADI MAX32 ADC driver violated this contract by comparing the buffer size in bytes against a sample count without accounting for the sample size (uint16_t), allowing a buffer half the required size to be accepted. This results in writes beyond the buffer boundary during ADC sampling, causing kernel memory corruption. On builds with CONFIG_USERSPACE, unprivileged user-mode threads with access to the ADC device can exploit this to write attacker-controlled data beyond their memory partition, enabling privilege escalation or denial of service. The vulnerability affects Zephyr versions >=4.0.0 and <4.4.2. The fix replaces the faulty check with a call to a shared helper function that correctly validates the buffer size accounting for sample size and extra samplings, returning an error if the buffer is insufficient.

An unprivileged user-mode thread with access to the ADI MAX32 ADC device can cause kernel memory corruption by triggering a buffer overrun during ADC sampling. This memory corruption can lead to privilege escalation or denial of service. The vulnerability affects Zephyr OS builds with CONFIG_USERSPACE enabled. Without CONFIG_USERSPACE, the issue remains a robustness defect on the caller side. The CVSS 3.1 score is 7.8 (high severity) reflecting local attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available and implemented in Zephyr versions 4.4.2 and later. The fix replaces the incorrect buffer size check with a call to a shared helper function that correctly validates the buffer size before sampling starts. Users should upgrade to Zephyr 4.4.2 or later to remediate this vulnerability. Until patched, avoid granting unprivileged user-mode threads access to the ADI MAX32 ADC device to mitigate exploitation risk.