Back to the CVE list

CVE-2026-19571

Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer

CVSS score

6.7

EPSS probability

%0.1

Risk score

0.0

Published

10 d ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

9.8

CVE-2026-5067Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

Vendorzephyrproject-rtos ProductZephyr+2 etkilenen

Patch verifiedEPSS %14 mo ago

7.5

CVE-2026-8023Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read

Vendorzephyrproject Productzephyr

Patch verifiedEPSS %13 mo ago

8.1

CVE-2026-10666Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

Vendorzephyrproject Productzephyr

Patch verifiedEPSS %13 mo ago

9.8

CVE-2026-13214Stack buffer overflow in OCPP GetConfiguration key parsing

Vendorzephyrproject Productzephyr

Patch verifiedEPSS %11 mo ago

8.2

CVE-2026-10672Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

Vendorzephyrproject Productzephyr

Patch verifiedEPSS %13 mo ago

8.2

CVE-2025-2962Infinite loop in dns_copy_qname

Vendorzephyrproject-rtos ProductZephyr+2 etkilenen

Patch verifiedEPSS %11 y ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-19571"