CVE-2026-10664

{"id": "CVE-2026-10664", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10664", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T15:47:33.072312Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "4.4.0", "lessThan": "4.4.1", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["drivers/wifi/nrf_wifi/src/wifi_mgmt.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-07-12T17:16:24.317", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/a2c4324acd50a5f92e492e6e460e6297af826148", "tags": ["Patch"], "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3r6j-pm38-r43m", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3r6j-pm38-r43m", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow entries from an nrf_wifi_umac_event_power_save_info event into the fixed-size twt_flows[WIFI_MAX_TWT_FLOWS] (8-element) array of a caller-supplied struct wifi_ps_config, looping over event-provided num_twt_flows without validating it against WIFI_MAX_TWT_FLOWS or checking event_len. When num_twt_flows exceeds 8, the handler writes past the destination array (which is typically on the caller's stack, e.g. the wifi ps shell command) -- an out-of-bounds write of ~40-byte TWT entries -- and reads twt_flow_info[i] past the event buffer. The event is delivered by the nRF70 co-processor firmware in response to a host-initiated power-save GET, so reaching the overflow requires the firmware to emit a malformed or out-of-range event; the trust boundary is host-to-trusted-coprocessor rather than a direct remote-AP write, with over-the-air influence on the flow count being indirect and bounded by the 3-bit TWT flow-id space. Affected: builds with CONFIG_NRF70_STA_MODE on releases through v4.4.0. The fix rejects events with num_twt_flows > WIFI_MAX_TWT_FLOWS or with event_len shorter than the claimed entries, and adds a NULL check on the caller buffer."}, {"lang": "es", "value": "El gestor de eventos de ahorro de energ\u00eda del controlador Wi-Fi nRF70 nrf_wifi_event_proc_get_power_save_info() en drivers/wifi/nrf_wifi/src/wifi_mgmt.c copi\u00f3 entradas de flujo TWT (Target Wake Time) de un evento nrf_wifi_umac_event_power_save_info en el array de tama\u00f1o fijo twt_flows[WIFI_MAX_TWT_FLOWS] (de 8 elementos) de una estructura wifi_ps_config proporcionada por el llamador, iterando sobre num_twt_flows proporcionado por el evento sin validarlo contra WIFI_MAX_TWT_FLOWS o verificar event_len. Cuando num_twt_flows excede 8, el gestor escribe m\u00e1s all\u00e1 del array de destino (que t\u00edpicamente est\u00e1 en la pila del llamador, p. ej. el comando de shell wifi ps) -- una escritura fuera de l\u00edmites de entradas TWT de ~40 bytes -- y lee twt_flow_info[i] m\u00e1s all\u00e1 del b\u00fafer del evento. El evento es entregado por el firmware del coprocesador nRF70 en respuesta a un GET de ahorro de energ\u00eda iniciado por el host, por lo que alcanzar el desbordamiento requiere que el firmware emita un evento malformado o fuera de rango; el l\u00edmite de confianza es de host a coprocesador de confianza en lugar de una escritura directa de AP remoto, con la influencia por aire en el recuento de flujos siendo indirecta y limitada por el espacio de ID de flujo TWT de 3 bits. Afectado: compilaciones con CONFIG_NRF70_STA_MODE en versiones hasta la v4.4.0. La correcci\u00f3n rechaza eventos con num_twt_flows > WIFI_MAX_TWT_FLOWS o con event_len m\u00e1s corto que las entradas declaradas, y a\u00f1ade una verificaci\u00f3n de NULL en el b\u00fafer del llamador."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F363494-36D4-4242-B8FB-1E4437D12664", "versionEndExcluding": "4.5.0", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerabilities@zephyrproject.org"}