CVE-2026-78119 Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length

[
  {
    "vendor": "zephyrproject",
    "product": "zephyr",
    "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
    "packageName": "zephyr",
    "defaultStatus": "unaffected",
    "programFiles": [
      "drivers/espi/espi_npcx.c",
      "drivers/espi/espi_taf_npcx.c",
      "soc/arm/nuvoton_npcx/common/soc_espi_taf.h",
      "soc/nuvoton/npcx/common/soc_espi_taf.h"
    ],
    "programRoutines": [
      {
        "name": "espi_taf_npcx_flash_write"
      },
      {
        "name": "espi_taf_npcx_rpmc_op1"
      },
      {
        "name": "espi_taf_parse"
      },
      {
        "name": "taf_npcx_completion_handler"
      }
    ],
    "versions": [
      {
        "version": "3.6.0",
        "status": "affected",
        "lessThan": "4.5.0",
        "versionType": "semver"
      }
    ]
  }
]