CVE-2026-14986
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The ITE it51xxx I2C driver, when acting as an I2C target (slave) in buffer mode, copies host-supplied write data into a fixed-size buffer (default 256 bytes) without a pre-write bounds check. The running index data->w_index accumulates across FIFO-fill interrupts and is reset only on STOP or timeout, so a single write transaction longer than the buffer causes an out-of-bounds write. The flaw is triggered by a malicious or misbehaving I2C master on the same bus.
Risk Assessment
The vulnerability allows an out-of-bounds write driven from the I2C bus, which can crash the controller or, with attacker-controlled values and length, be shaped toward code execution in the target's kernel/firmware context. No software privilege on the victim is required; only access to the I2C bus is needed.
Recommendation
Update the driver to a version that adds a pre-write bounds check in target_i2c_fifo_read_to_buf() (the fix aborts and resets the FIFO before any out-of-bounds store). Until patched, consider disabling CONFIG_I2C_TARGET_BUFFER_MODE or isolating the I2C bus from untrusted devices.
Related vulnerabilities
- CVE-2026-119344Critical
Cocos AI in version 0.8.2 and earlier accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. The vulnerability is addressed in 0.9.0, but cannot be patched in source code alone since it arises from the confidential computing threat model itself.
- CVE-2026-83542Critical
A Code Injection vulnerability in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding mainDecoratorLocation, causing evaluation of an unsandboxed Groovy expression.
- CVE-2026-117691Critical
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
- CVE-2026-96677Critical
Cross-site Scripting (XSS) vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in page chrome fields (header, nav, footer, etc.), so applications that place request-derived values there reflect them unencoded.
- CVE-2026-73117Critical
HTTP Response Splitting (CRLF injection in HTTP headers) vulnerability in Apache Juneau. The REST server passed response header values and redirect targets to the servlet container unchecked, so request-derived data could allow header injection or redirect to an arbitrary site.
- CVE-2026-73116Critical
Insufficiently Protected Credentials vulnerability in Apache Juneau. The RestClient followed HTTP redirects while keeping credential headers from the original request, so a server redirecting to a different host, port, or from HTTPS to HTTP could receive Authorization, Cookie, Proxy-Authorization and X-API-Key headers.
- CVE-2026-73101Critical
Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response and may include internal exception messages in the error body, even with stack-trace rendering disabled.
- CVE-2026-73100Critical
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests ending in a server error without redaction, so Authorization, Cookie, Proxy-Authorization and X-API-Key headers are written in cleartext to the application log.
- CVE-2026-73099Critical
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body and is enabled by default on every HTTP method including GET, so a cross-site link can deliver an attacker-chosen request body without a CORS preflight.
- CVE-2026-73098Critical
Improper control of dynamically-loaded code vulnerability in Apache Juneau. When parsing a value into a property of type java.lang.Class, the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer.
Original NVD description (English source)
The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data->w_index] and only checks data->w_index against sizeof(data->target_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow. The running index data->w_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data->w_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->target_out_buffer and following static device data. The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS