CVE-2026-102730

Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.)

Score

CVSS 4.0 8.6 High

Status

Awaiting Analysis - emo@eclipse.org

Published

2026-09-29

Last modified

2026-09-29

Weaknesses

CWE-1284, CWE-787

Affected products

• Eclipse-threadxlevelxnand Driver (Eclipse Foundation)

References

• https://github.com/eclipse-threadx/levelx/security/advisories/GHSA-q6ph-7238-777g