CVE-2026-78119 | Zephyr Project up to 4.4.x Nuvoton NPCX eSPI Driver drivers/espi/espi_npcx.c espi_taf_parse out-of-bounds write

October 21, 2026 Yanac

A vulnerability described as critical has been identified in Zephyr Project Zephyr up to 4.4.x. Impacted is the function espi_taf_parse of the file drivers/espi/espi_npcx.c of the component Nuvoton NPCX eSPI Driver. The manipulation results in out-of-bounds write.

This vulnerability was named CVE-2026-78119. The attack needs to be approached locally. There is no available exploit.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More