Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L N R U N N H 5.5 .0015 4.8 —
AFFECTED Product Versions Fixed zephyr 3.5.0 – —
TIMELINE Jun 2 Reserved by zephyr Jun 22 EXPLOIT PUBLISHED — CVE-2026-10645 (zephyrproject zephyr). Public exploit reference added. Jun 22 Published (CNA: zephyr)
The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory block. ext2_fetch_direntry() guarded only with de_name_len > EXT2_MAX_FILE_NAME, but de_name_len is a uint8_t and EXT2_MAX_FILE_NAME is 255, so the check is always false; the function then memcpy'd up to 255 name bytes and the lookup/readdir paths advanced traversal by an unvalidated de_rec_len. Each directory block is read into a block_size-sized slab buffer, and block_off can be driven near the block end by preceding entries' rec_len, so the 8-byte header read and the subsequent name memcpy can read up to ~263 bytes past the end of the block buffer into adjacent heap/slab memory. On the readdir path those bytes are returned to the caller in fs_dirent.name, leaking adjacent kernel heap memory; a de_rec_len of 0 also causes a zero-progress infinite loop (denial of service), and the unlink path's memmove(de, next, next_reclen) over unvalidated records is an additional OOB read/write source. The defect is reached by any path-based operation (open, stat, unlink, rename, mkdir) or directory listing on a mounted ext2 volume, so a crafted or corrupted ext2 image on attacker-supplied storage (SD card, USB mass storage, or otherwise mounted image) triggers it. Affected: Zephyr ext2 from its introduction in v3.5.0 through v4.4.0. The fix validates rec_len and name_len in the parser and rejects entries whose header does not fit the remaining block or whose rec_len crosses the block boundary in every traversal caller.
| Date | Event | Detail |
|---|---|---|
| June 2, 2026 | Reserved | Reserved by zephyr |
| June 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-10645 (zephyrproject zephyr). Public exploit reference added. |
| June 22, 2026 | Published | Published (CNA: zephyr) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| zephyrproject | zephyr | — | 3.5.0 | — |
Authoritative record: CVE-2026-10645 at cve.org
Vendors: zephyrproject
Weaknesses: CWE-125
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-10645 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.