CVE-2026-78119: bounds in zephyrproject zephyr

The vulnerability exists in the espi_taf_parse() function of the Nuvoton NPCX eSPI driver in Zephyr OS, where the 12-bit length field from TAF request headers is used without proper bounds checking. This leads to up to 956 bytes of out-of-bounds writes into the .bss section and reads beyond the FLASHRXBUF register array. The flaw allows an attacker with host firmware or bus-level control to corrupt embedded controller memory, potentially bypassing flash protection mechanisms. The defect is reachable only by requests violating the negotiated payload size, which normal host software cannot generate. The patch widens counters, enforces strict length checks, rejects oversized requests, and adds handling for unsupported cycle types. Only NPCX/NPCK targets with CONFIG_ESPI_TAF enabled are affected, and no in-tree boards enable this by default.

An attacker with host firmware or bus-level control can cause out-of-bounds memory writes and reads in the embedded controller, leading to controller crashes, hangs, or corruption of driver state that manages flash protection regions. This compromises the trust boundary between host and embedded controller, potentially allowing unauthorized flash memory modification or denial of service. The vulnerability has a CVSS 3.1 score of 6.3 (medium severity) with low attack vector (local), low attack complexity, high privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and high availability impact.

A fix is available that enforces strict bounds checking on the length fields in TAF requests, rejects requests exceeding negotiated payload sizes, and properly handles unsupported cycle types. Users should upgrade Zephyr OS to versions 4.5.0 or later where this vulnerability is patched. Only configurations with CONFIG_ESPI_TAF enabled on NPCX/NPCK targets are affected; disabling this configuration or avoiding use of affected versions mitigates the risk. Since this is not a cloud service, remediation depends on applying the vendor patch.