CVE-2026-10678 NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller

[
  {
    "vendor": "zephyrproject",
    "product": "zephyr",
    "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
    "packageName": "zephyr",
    "defaultStatus": "unaffected",
    "programFiles": [
      "include/zephyr/pmci/mctp/mctp_i2c_gpio_target.h",
      "subsys/pmci/mctp/mctp_i2c_gpio_controller.c",
      "subsys/pmci/mctp/mctp_i2c_gpio_target.c"
    ],
    "versions": [
      {
        "version": "4.3.0",
        "status": "affected",
        "lessThan": "4.5.0",
        "versionType": "semver"
      }
    ]
  }
]