What is CVE-2026-10673?

CVE-2026-10673 is a high-severity vulnerability in Zephyrproject Zephyr, classified under Out-of-bounds Read. CVSS score: 8.3/10. Published 2026-07-15.

How severe is CVE-2026-10673?

High severity. CVSS v3 base score is 8.3 out of 10.

Out-of-bounds Read in Zephyrproject Zephyr

CVE-2026-10673

The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx…

Vulnerability class: Buffer Overflow

CVSS v3 metric

CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.

Affected products

Zephyrproject Zephyr — versions 3.7.0

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read
CWE-787 — Out-of-bounds Write

References

vulnerabilities@zephyrproject.org (patch)
vulnerabilities@zephyrproject.org (patch)
vulnerabilities@zephyrproject.org

Frequently asked questions

What is CVE-2026-10673?: CVE-2026-10673 is a high-severity vulnerability in Zephyrproject Zephyr, classified under Out-of-bounds Read. CVSS score: 8.3/10. Published 2026-07-15.
How severe is CVE-2026-10673?: High severity. CVSS v3 base score is 8.3 out of 10.