CVE-2026-19184 NXP GAU ADC Driver Buffer Overrun Vulnerability – Analysis & Mitigation

Vulnerability Overview

What is CVE-2026-19184

CVE-2026-19184 is a buffer overrun vulnerability in the NXP GAU ADC (Analog-to-Digital Converter) driver that permits memory corruption through improper validation of caller-supplied buffer sizes. The vulnerability exists in the driver’s failure to correctly validate the relationship between the provided buffer size and the number of active ADC channels, allowing writes to extend beyond allocated memory boundaries.

The flaw operates at the kernel driver level, making it particularly dangerous in systems where user-mode applications maintain access to ADC devices. In configurations with CONFIG_USERSPACE=y enabled, unprivileged threads can trigger the vulnerability, potentially escalating privileges or corrupting critical kernel memory structures.

Affected Products and Versions

Affected Component:

• NXP GAU ADC Driver (drivers/adc/adc_mcux_gau_adc.c)

Vulnerable Versions:

• All versions prior to the security patch release
• Commonly found in Zephyr RTOS deployments
• Affects embedded systems using NXP MCU platforms with GAU ADC peripherals

Deployment Contexts:

• Industrial IoT devices
• Automotive embedded systems
• Medical device controllers
• Real-time monitoring systems
• Edge computing platforms

Severity Assessment

Technical Breakdown

Root Cause: Buffer Size Validation Flaw

The vulnerability stems from a critical logic error in how the NXP GAU ADC driver processes buffer size parameters. The driver’s validation mechanism contains two distinct failures:

Primary Validation Flaw:
The driver accepts a buffer_size parameter from user-mode callers and validates it against the number of active channels. However, this validation treats the buffer size as a sample count rather than a byte count. The code then directly stores this value in data->results_length and uses it in mcux_gau_adc_read_samples() without recalculating for actual byte requirements.

Calculation Mismatch:

Expected behavior:
  buffer_size_bytes = active_channels × sample_size_bytes
Actual behavior:
  results_length = buffer_size (treated as sample count)
  actual_write_size = active_channels × sample_size_bytes

This mismatch allows an attacker to provide a buffer that is half the required size. The driver then writes ADC conversion results at twice the expected rate, overflowing the allocated memory.

Example Scenario:

• System configured with 8 active ADC channels
• Each sample requires 2 bytes (16-bit conversion result)
• Required buffer: 8 channels × 2 bytes = 16 bytes per sample set
• Attacker provides: 8-byte buffer (claiming 8 samples)
• Driver writes: 16 bytes of data into 8-byte buffer
• Result: 8-byte overflow into adjacent kernel memory

Memory Corruption Mechanism

The buffer overrun corrupts kernel memory in predictable patterns:

Immediate Impact:

• Overflow into adjacent kernel heap structures
• Corruption of kernel data structures (task control blocks, memory descriptors)
• Potential corruption of function pointers or security-critical data

Secondary Effects:

• Kernel panic or system crash (denial of service)
• Uncontrolled code execution if function pointers are overwritten
• Privilege escalation through kernel memory manipulation
• Information disclosure from kernel memory leakage

Memory Layout Vulnerability:
The ADC driver operates in supervisor mode with direct access to kernel memory. When user-mode threads trigger the buffer overrun, the supervisor-mode write operations corrupt memory that user-mode code cannot directly access, bypassing normal memory protection mechanisms.

Exploitation Requirements and Conditions

Necessary Conditions:

1. NXP GAU ADC driver present and vulnerable version active
2. User-mode thread access to ADC device (typically /dev/adc or similar)
3. Ability to call ADC read operations with custom buffer parameters
4. CONFIG_USERSPACE=y enabled (for user-mode exploitation)

Exploitation Complexity:

• Low complexity: Basic buffer manipulation; no advanced exploitation techniques required
• Predictable behavior: Memory corruption follows deterministic patterns
• No ASLR bypass needed: Kernel memory layout often predictable in embedded systems
• No gadget chains required: Direct memory corruption sufficient for DoS; privilege escalation possible through targeted overwrites

System Configurations at Higher Risk:

• Systems with permissive device access controls
• Deployments without memory protection (SMMU/IOMMU disabled)
• Configurations with multiple user-mode applications accessing ADC
• Systems without kernel address space layout randomization (KASLR)

Attack Vectors and Scenarios

Buffer Overrun Exploitation

Attack Flow:

1. Reconnaissance Phase

• Attacker identifies ADC device availability
• Determines active channel count through device queries
• Calculates required buffer size for full channel sampling

1. Exploitation Phase

• Attacker allocates undersized buffer (50% of required size)
• Submits ADC read request with malicious buffer_size parameter
• Driver validates against channel count but miscalculates byte requirements
• Driver writes full ADC results, overflowing allocated buffer

1. Payload Delivery

• Overflow data corrupts adjacent kernel memory
• Attacker controls overflow content through ADC channel configuration
• Specific memory targets depend on kernel heap layout

Practical Example:

Vulnerable Code Pattern:
  buffer_size = user_provided_size;  // e.g., 8 bytes
  active_channels = 8;
  if (buffer_size >= active_channels) {  // Validation passes: 8 >= 8
    data->results_length = buffer_size;  // Stores 8
  }
  // Later in mcux_gau_adc_read_samples():
  for (i = 0; i < active_channels; i++) {
    write_to_buffer(buffer, adc_result[i]);  // Writes 16 bytes into 8-byte buffer
  }

Privilege Escalation Pathways

Kernel Memory Corruption Route:

1. Attacker overwrites kernel task structure in adjacent memory
2. Modifies task capabilities or security context
3. Escalates from user-mode to kernel-mode execution
4. Gains full system access

Function Pointer Hijacking:

1. Overflow corrupts function pointers in kernel structures
2. Attacker redirects execution to malicious code
3. Executes arbitrary code in kernel context
4. Establishes persistent access mechanism

Security Descriptor Manipulation:

1. Corrupts access control lists in kernel memory
2. Modifies file permissions or capability bits
3. Grants unauthorized access to protected resources
4. Bypasses security policy enforcement

Likelihood Assessment:

• High in systems without memory tagging or protection
• Medium in systems with basic SMMU/IOMMU protection
• Lower in systems with comprehensive kernel hardening

Denial of Service Impact

Crash-Based DoS:

• Buffer overflow triggers kernel panic
• System becomes unavailable immediately
• No recovery without manual intervention
• Particularly effective in unattended embedded systems

Resource Exhaustion:

• Repeated exploitation corrupts kernel memory allocator
• System unable to allocate new memory
• Services fail progressively
• Difficult to diagnose without detailed logging

Cascading Failures:

• Initial overflow corrupts task scheduler
• Subsequent task switches cause additional crashes
• System enters unstable state
• Multiple services affected simultaneously

Risk Assessment

Threat Landscape for Your Environment

High-Risk Environments:

• Industrial control systems with ADC-based monitoring
• Automotive systems using ADC for sensor data
• Medical devices with continuous analog monitoring
• IoT gateways processing sensor data
• Real-time systems where uptime is critical

Risk Multipliers:

• Multiple user-mode applications accessing ADC
• Insufficient access control on device files
• Lack of kernel memory protection mechanisms
• Absence of security monitoring
• Delayed patching cycles

Threat Actor Profiles:

• Local attackers: Direct access to vulnerable system
• Supply chain compromises: Malicious firmware with vulnerable driver
• Insider threats: Authorized users exploiting vulnerability
• Automated worms: Self-propagating malware targeting embedded systems

Systems Most at Risk

Immediate Risk (Critical Priority):

• Production systems with CONFIG_USERSPACE=y and permissive ADC access
• Multi-tenant embedded systems where isolation is critical
• Systems with known ADC-dependent functionality
• Devices in security-sensitive environments (healthcare, industrial)

Secondary Risk (High Priority):

• Systems with CONFIG_USERSPACE disabled but kernel-mode ADC access
• Devices with limited monitoring capabilities
• Systems in environments with sophisticated threat actors
• Legacy deployments with extended support requirements

Lower Risk (Standard Priority):

• Systems with strict ADC access controls
• Deployments with comprehensive kernel hardening
• Devices with active memory protection mechanisms
• Systems with rapid patching capabilities

Real-World Exploitation Likelihood

Current Threat Assessment:

• Proof-of-concept availability: Likely within 30-60 days of public disclosure
• Automated exploitation: Possible within 90 days
• Active exploitation: Expected in targeted attacks within 6 months
• Widespread exploitation: Depends on deployment prevalence

Factors Increasing Likelihood:

• Simplicity of exploitation (low technical barrier)
• Availability of vulnerable systems in production
• High-value targets using affected platforms
• Lack of compensating controls in many deployments

Factors Decreasing Likelihood:

• Rapid patching by NXP and Zephyr project
• Limited public documentation of exploitation techniques
• Deployment in air-gapped or restricted environments
• Presence of intrusion detection systems

Detection and Identification

Determine Your Driver Version

Method 1: Direct Version Query

# Check Zephyr driver version
grep -r "adc_mcux_gau_adc" /path/to/zephyr/drivers/adc/
# Examine driver source for version information
cat drivers/adc/adc_mcux_gau_adc.c | grep -i "version\|date"
# Check kernel module information (if applicable)
modinfo adc_mcux_gau_adc

Method 2: Build Configuration Review

# Examine build artifacts
strings /path/to/kernel/image | grep -i "gau_adc"
# Check device tree for ADC configuration
grep -r "gau_adc" /path/to/device/tree/
# Review build logs for driver compilation
grep "adc_mcux_gau_adc" build.log

Method 3: Runtime Detection

# Query device capabilities
cat /sys/class/adc/*/name
# Check driver loaded in kernel
lsmod | grep adc
# Examine device attributes
ls -la /dev/adc*

Version Mapping:
| Version Range | Status | Action Required |
|—|—|—|
| Pre-patch (varies by distribution) | Vulnerable | Immediate patching required |
| Post-patch release | Patched | Verify patch application |
| Development branch (post-fix) | Secure | No action needed |

Static Code Analysis Approach

Automated Analysis:

# Use static analysis tools to identify buffer validation issues
clang-analyzer drivers/adc/adc_mcux_gau_adc.c
# Scan for buffer size validation patterns
grep -n "buffer_size\|results_length" drivers/adc/adc_mcux_gau_adc.c
# Identify potential overflow patterns
cppcheck --enable=all drivers/adc/adc_mcux_gau_adc.c

Manual Code Review Checklist:

• [ ] Locate mcux_gau_adc_read_samples() function
• [ ] Identify buffer size validation logic
• [ ] Verify buffer size is converted to bytes correctly
• [ ] Confirm overflow protection for all write operations
• [ ] Check for off-by-one errors in loop conditions
• [ ] Validate channel count handling

Critical Code Patterns to Examine:

// VULNERABLE PATTERN - Look for this:
if (buffer_size >= active_channels) {  // Wrong comparison
    data->results_length = buffer_size;  // Stores sample count as byte count
}
// SECURE PATTERN - Should look like this:
required_bytes = active_channels * sizeof(adc_sample_t);
if (buffer_size >= required_bytes) {
    data->results_length = required_bytes;
}

Dynamic Testing and Monitoring Techniques

Fuzz Testing:

# Create test harness for ADC driver
# Provide varying buffer sizes and channel configurations
# Monitor for crashes, memory corruption, or unexpected behavior
# Example test parameters:
# - buffer_size: 1 to 1000 bytes
# - active_channels: 1 to 32
# - sample_rates: 1 to 1000000 Hz
# - data patterns: sequential, random, maximum values

Runtime Monitoring:

# Enable kernel memory debugging
echo 1 > /proc/sys/kernel/kptr_restrict
# Monitor for ADC-related crashes
dmesg | grep -i "adc\|buffer\|overflow"
# Track memory access patterns
perf record -e mem_load_uops_retired.all_loads -a
# Monitor system calls to ADC device
strace -e ioctl -p <pid>

Behavioral Indicators:

• Unexpected kernel panics during ADC operations
• Memory corruption errors in kernel logs
• Segmentation faults in ADC-accessing applications
• Unusual memory access patterns in performance monitoring
• Repeated system crashes after ADC initialization

Detection Rules for SIEM/Monitoring:

Alert on:
- Kernel panic messages containing "adc" or "buffer"
- Multiple ADC device access attempts from single process
- ADC read operations with unusual buffer sizes
- Memory corruption errors in kernel logs
- Privilege escalation attempts following ADC access

Remediation Strategy

Immediate Patching Steps

Priority 1: Apply Security Patch (Within 24-48 Hours)

1. Identify Patch Source

• Check NXP security advisories
• Review Zephyr project release notes
• Consult your device manufacturer’s security updates

1. Pre-Patch Verification

   # Backup current configuration
   cp -r /path/to/zephyr/drivers/adc /path/to/backup/adc_backup
   # Document current driver version
   git log --oneline drivers/adc/adc_mcux_gau_adc.c | head -5

1. Apply Patch

   # Update to patched version
   git pull origin main
   git checkout <patched-commit-hash>
   # Or apply patch file directly
   patch -p1 < cve-2026-19184.patch

1. Rebuild and Verify

   # Clean build
   rm -rf build/
   west build -b <board> -t clean
   # Rebuild with patched driver
   west build -b <board>
   # Verify patch applied
   grep -A 5 "buffer_size validation" drivers/adc/adc_mcux_gau_adc.c

1. Deploy to Production

• Test in staging environment first
• Verify ADC functionality remains intact
• Monitor for regressions
• Deploy to production systems
• Document patch application date and version

Patch Verification Checklist:

• [ ] Patch file integrity verified (checksum validation)
• [ ] Patch applies cleanly without conflicts
• [ ] Build completes successfully
• [ ] No new compiler warnings introduced
• [ ] ADC functionality tested and working
• [ ] Performance impact assessed (should be minimal)

Buffer Validation Implementation

Enhanced Validation Logic:

// SECURE IMPLEMENTATION
static int mcux_gau_adc_read(const struct device *dev,
                             const struct adc_read_request *request)
{
    struct mcux_gau_adc_data *data = dev->data;
    // Calculate required buffer size in bytes
    uint32_t required_bytes = data->active_channels * sizeof(uint16_t);
    // Validate buffer size BEFORE storing
    if (request->buffer_size < required_bytes) {
        LOG_ERR("Buffer too small: %u < %u bytes required",
                request->buffer_size, required_bytes);
        return -EINVAL;
    }
    // Store validated size
    data->results_length = required_bytes;
    // Additional safety checks
    if (data->results_length > MAX_BUFFER_SIZE) {
        LOG_ERR("Buffer size exceeds maximum: %u > %u",
                data->results_length, MAX_BUFFER_SIZE);
        return -EINVAL;
    }
    // Proceed with safe read operation
    return mcux_gau_adc_read_samples(dev, request->buffer);
}

Validation Best Practices:

• Always convert buffer sizes to bytes explicitly
• Validate against actual data requirements, not sample counts
• Implement bounds checking on all buffer operations
• Use safe integer arithmetic (check for overflow)
• Log validation failures for security monitoring
• Fail securely (reject invalid requests, don’t attempt workarounds)

Access Control Hardening

Device Access Restrictions:

# Restrict ADC device to authorized users only
chmod 640 /dev/adc*
chown root:adc_users /dev/adc*
# Create dedicated ADC user group
groupadd -r adc_users
# Add only necessary applications to group
usermod -a -G adc_users <application_user>

Kernel Configuration Hardening:

# Enable user-space memory protection
CONFIG_USERSPACE=y
CONFIG_MEMORY_PROTECTION=y
# Enable kernel address space layout randomization
CONFIG_ASLR=y
# Enable stack canaries
CONFIG_STACK_CANARIES=y
# Enable memory tagging (if supported)
CONFIG_MTE=y
# Disable unnecessary ADC features
CONFIG_ADC_DEBUG=n

Application-Level Access Control:

// Implement capability-based access control
#include <sys/capability.h>
int open_adc_device(const char *device_path)
{
    // Verify process has required capabilities
    cap_t caps = cap_get_proc();
    cap_flag_value_t cap_value;
    cap_get_flag(caps, CAP_SYS_RAWIO, CAP_EFFECTIVE, &cap_value);
    if (cap_value != CAP_SET) {
        LOG_ERR("Process lacks required capabilities for ADC access");
        return -EPERM;
    }
    // Open device with minimal permissions
    int fd = open(device_path, O_RDONLY);
    if (fd < 0) {
        LOG_ERR("Failed to open ADC device: %s", strerror(errno));
        return -1;
    }
    return fd;
}

Operational Hardening

Userspace Protection Configuration

Enable Comprehensive Memory Protection:

# Zephyr configuration for enhanced protection
CONFIG_USERSPACE=y
CONFIG_MEMORY_PROTECTION=y
CONFIG_STACK_CANARIES=y
CONFIG_BOUNDS_CHECKING_ENABLED=y
# Memory isolation settings
CONFIG_MEMORY_DOMAIN_ISOLATION=y
CONFIG_PRIVILEGED_STACK_SIZE=2048
CONFIG_USERSPACE_STACK_SIZE=4096

Thread Isolation:

// Create isolated thread for ADC operations
K_THREAD_DEFINE(adc_thread, ADC_STACK_SIZE, adc_thread_func,
                NULL, NULL, NULL,
                K_PRIO_PREEMPT(10),
                K_USER,  // Run in user mode
                0);
// Restrict thread capabilities
static void adc_thread_func(void *p1, void *p2, void *p3)
{
    // Thread runs with minimal privileges
    // Can only access ADC device, not other kernel resources
    while (1) {
        // ADC operations only
        perform_adc_read();
        k_sleep(K_MSEC(100));
    }
}

Memory Compartmentalization:

# Separate memory regions for different components
CONFIG_MEMORY_REGIONS=y
# Define memory regions in device tree
adc_memory {
    compatible = "memory-region";
    reg = <0x20000000 0x1000>;  // 4KB for ADC buffers
    label = "adc_region";
};
kernel_memory {
    compatible = "memory-region";
    reg = <0x20001000 0x7000>;  // Kernel memory
    label = "kernel_region";
};

Logging and Alerting Setup

Comprehensive Logging Configuration:

# Enable ADC driver logging
CONFIG_ADC_LOG_LEVEL_DBG=y
# Enable kernel memory protection logging
CONFIG_MEMORY_PROTECTION_LOG_LEVEL_DBG=y
# Enable security event logging
CONFIG_SECURITY_LOG_LEVEL_INF=y

Log Collection and Analysis:

# Collect ADC-related events
journalctl -u adc-service -f
# Monitor for buffer overflow indicators
grep -E "buffer|overflow|corruption" /var/log/kernel.log
# Alert on suspicious patterns
tail -f /var/log/kernel.log | grep -i "adc.*error\|buffer.*fail"

Alert Rules Configuration:

# Prometheus alerting rules for ADC monitoring
groups:
  - name: adc_security
    rules:
      - alert: ADCBufferOverflowAttempt
        expr: increase(adc_buffer_validation_failures_total[5m]) > 0
        for: 1m
        annotations:
          summary: "ADC buffer validation failure detected"
          severity: "critical"
      - alert: ADCAccessDenied
        expr: increase(adc_access_denied_total[5m]) > 5
        for: 5m
        annotations:
          summary: "Multiple ADC access denials detected"
          severity: "warning"
      - alert: KernelMemoryCorruption
        expr: increase(kernel_memory_corruption_errors_total[5m]) > 0
        for: 1m
        annotations:
          summary: "Kernel memory corruption detected"
          severity: "critical"

Structured Logging Format:

{
  "timestamp": "2026-01-15T10:30:45Z",
  "event_type": "adc_operation",
  "severity": "error",
  "component": "adc_mcux_gau",
  "message": "Buffer validation failed",
  "details": {
    "requested_size": 8,
    "required_size": 16,
    "active_channels": 8,
    "process_id": 1234,
    "user_id": 1000
  },
  "action_taken": "request_rejected"
}

Incident Response Preparation

Incident Response Plan for CVE-2026-19184:

Phase 1: Detection and Alerting

• Automated alerts trigger on buffer validation failures
• Security team notified immediately
• Incident severity assessed
• Initial containment measures activated

Phase 2: Containment

# Immediate response script
#!/bin/bash
# Disable ADC device access
echo 0 > /sys/class/adc/adc0/enabled
# Isolate affected process
kill -STOP <affected_pid>
# Capture memory state for forensics
gdb -p <affected_pid> -batch -ex "dump memory /tmp/memory.dump 0x20000000 0x20010000"
# Log incident details
logger -t incident "CVE-2026-19184 exploitation attempt detected and contained"

Phase 3: Investigation

• Analyze logs for exploitation attempts
• Examine memory dumps for corruption patterns
• Identify affected systems and processes
• Determine scope of compromise

Phase 4: Recovery

• Apply security patches to all systems
• Verify patch effectiveness
• Restore from clean backups if necessary
• Monitor for recurrence

Phase 5: Post-Incident

• Document lessons learned
• Update security policies
• Enhance monitoring capabilities
• Conduct security training

Incident Response Checklist:

• [ ] Incident declared and severity assessed
• [ ] Affected systems identified and isolated
• [ ] Evidence collected and preserved
• [ ] Patches applied to all systems
• [ ] Functionality verified post-patch
• [ ] Monitoring enhanced for future detection
• [ ] Post-incident review completed
• [ ] Stakeholders notified

Frequently Asked Questions

How do I verify if my NXP GAU ADC driver is vulnerable?

Check your driver version against the affected versions list. Vulnerable versions are those prior to the security patch in drivers/adc/adc_mcux_gau_adc.c.

Verification steps:

1. Identify your Zephyr version: git describe --tags
2. Check if your version is before the patch release
3. Review your system’s driver source code for the vulnerable validation logic
4. Use static analysis tools to scan for the specific buffer validation flaw
5. Consult NXP’s security advisory for your specific platform

If you’re unsure, assume vulnerability and apply patches immediately.

What is the difference between this vulnerability and standard buffer overflows?

CVE-2026-19184 specifically exploits improper validation of buffer_size against active channel counts, allowing writes up to twice the allocated buffer size. Unlike generic buffer overflows, this vulnerability:

• Operates at kernel driver level: Supervisor-mode code writes to user-provided buffers
• Bypasses normal protections: User-mode memory protection doesn’t prevent kernel-mode writes
• Enables privilege escalation: Kernel memory corruption can lead to unauthorized privilege elevation
• Predictable exploitation: Memory corruption follows deterministic patterns based on channel configuration
• Requires specific conditions: Needs ADC device access and vulnerable driver version

Standard buffer overflows typically occur in user-mode code and are constrained by memory protection mechanisms. This vulnerability leverages kernel privileges to corrupt memory that user-mode protections cannot defend.

Can this vulnerability be exploited without direct ADC device access?

No. Exploitation requires user-mode thread access to the ADC device. Systems with strict device access controls and disabled CONFIG_USERSPACE are at lower risk, though kernel-mode exploitation remains possible.

Access requirements:

• Read/write permissions on ADC device file
• Ability to submit ADC read requests
• Sufficient privileges to trigger ADC operations
• In some configurations: specific user group membership

Mitigation through access control:

• Restrict ADC device permissions (chmod 640)
• Limit ADC user group membership
• Disable ADC functionality if not needed
• Use SELinux/AppArmor policies to restrict device access

What should I prioritize if I have limited patching resources?

1. Immediate (24 hours): Restrict ADC device access to trusted applications only
2. Short-term (1 week): Enable CONFIG_USERSPACE protections if available
3. Medium-term (2 weeks): Implement monitoring for unusual memory access patterns
4. Long-term (1 month): Schedule and apply security patches to all systems

This prioritization reduces exploitation likelihood while you prepare for comprehensive patching.

Are there temporary workarounds if I cannot patch immediately?

Yes. Implement these compensating controls:

1. Disable ADC functionality if not critical to operations
2. Restrict user-mode access to the ADC device (chmod 600, owned by root)
3. Implement strict input validation at the application level before ADC operations
4. Enable comprehensive kernel memory monitoring and logging for detection
5. Isolate ADC operations to dedicated, monitored processes
6. Implement network segmentation to limit lateral movement if exploited
7. Increase monitoring frequency for security events and anomalies

These workarounds reduce risk but do not eliminate it. Patching remains the primary remediation.

References

Official Security Advisories:

• NXP Security Advisory for CVE-2026-19184
• Zephyr Project Security Release Notes
• NIST National Vulnerability Database (NVD) Entry

Technical Documentation:

• NXP GAU ADC Driver Documentation
• Zephyr RTOS ADC Subsystem Guide
• Zephyr Memory Protection Architecture

Related Security Resources:

• OWASP Buffer Overflow Prevention Cheat Sheet
• CWE-120: Buffer Copy without Checking Size of Input
• CWE-680: Integer Overflow to Buffer Overflow
• CERT Secure Coding Standards for C

Monitoring and Detection:

• Zephyr Logging Framework Documentation
• Linux Kernel Memory Protection Features
• SIEM Integration Guidelines for Embedded Systems

Document Version: 1.0
Last Updated: January 2026
Classification: Security Advisory
Distribution: Technical Security Professionals

This advisory is based on available technical analysis and vendor guidance. Organizations should conduct their own risk assessment based on their specific deployment configurations and threat landscape.