CVE-2026-19736 | Zephyr Project up to 4.4.2 NXP MCUX TRNG Entropy Driver entropy_mcux_trng.c entropy_get_entropy dataSize out-of-bounds write

October 11, 2026 Yanac

A vulnerability was found in Zephyr Project Zephyr up to 4.4.2. It has been declared as very critical. This impacts the function entropy_get_entropy of the file drivers/entropy/entropy_mcux_trng.c of the component NXP MCUX TRNG Entropy Driver. Such manipulation of the argument dataSize leads to out-of-bounds write.

This vulnerability is traded as CVE-2026-19736. An attack has to be approached locally. There is no exploit available.

Applying a patch is advised to resolve this issue.VulDB Recent EntriesRead More