CVE-2026-102730
Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX
CVSS 4.0 8.6 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-102730
PublishedMounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-102730 · CVE overview and exploitation status
cve-program · CVE-2026-102730
Related changes
Linked by CVE identifier- Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX · Affected-version evidence changed · 10 Nov 2026
- Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX · Affected-version evidence changed · 4 Nov 2026