CVE-2026-102730
Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX
CVSS Score
0.0
EPSS Score
0.1%
EPSS Percentile
2th
Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`.
| CWE | CWE-787 CWE-1284 |
| Vendor | eclipse foundation |
| Product | eclipse threadx levelx |
| Published | Sep 29, 2026 |
| Last Updated | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for eclipse foundation eclipse threadx levelx
Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse threadx levelx are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Eclipse Foundation / Eclipse ThreadX LevelX
HEAD `9f1cfdc` and prior; Finding 1 introduced by commit `47b2a17d`; Finding 2 is the un-patched half of the Nov-2025 fix `0f7dd521`.
References
Credits
🔍 adawn0106