Skip to content
Zephyrproject vulnerabilities
Newest
-
zephyrproject zephyr
NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame
CVE-2026-87045
7.5 High
-
zephyrproject zephyr
Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service
CVE-2026-87044
6.5 Medium
-
zephyrproject zephyr
sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready
CVE-2026-87043
4.8 Medium
-
zephyrproject zephyr
Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory
CVE-2026-87041
7.8 High
-
zephyrproject zephyr
Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write
CVE-2026-87040
8.3 High
-
zephyrproject zephyr
I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers
CVE-2026-87039
7.8 High
-
zephyrproject zephyr
Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode
CVE-2026-87038
7.0 High
-
zephyrproject zephyr
Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
CVE-2026-16511
8.8 High
-
zephyrproject zephyr
Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue
CVE-2026-85036
5.7 Medium
-
zephyrproject zephyr
Use-after-free via dynamically allocated message queue retained by the CAN RX filter
CVE-2026-85035
8.8 High
-
zephyrproject zephyr
Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers
CVE-2026-85034
6.7 Medium
-
zephyrproject zephyr
Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer
CVE-2026-85033
4.6 Medium
-
zephyrproject zephyr
Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress
CVE-2026-85032
4.8 Medium
-
zephyrproject zephyr
Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet
CVE-2026-82962
6.5 Medium
-
zephyrproject zephyr
Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode
CVE-2026-82961
7.8 High
-
zephyrproject zephyr
Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver
CVE-2026-82390
3.7 Low
-
zephyrproject zephyr
Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference
CVE-2026-82389
6.5 Medium
-
zephyrproject zephyr
Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host
CVE-2026-82388
5.3 Medium
-
zephyrproject zephyr
IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key
CVE-2026-19742
3.7 Low
-
zephyrproject zephyr
Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses
CVE-2026-81038
7.1 High
-
zephyrproject zephyr
Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity
CVE-2026-81039
4.3 Medium
-
zephyrproject zephyr
Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size
CVE-2026-79982
8.8 High
-
zephyrproject zephyr
DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing
CVE-2026-79981
6.5 Medium
-
zephyrproject zephyr
Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS
CVE-2026-79980
5.6 Medium
-
zephyrproject zephyr
Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames
CVE-2026-79979
7.8 High
-
zephyrproject zephyr
Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
CVE-2026-79978
3.6 Low
-
zephyrproject zephyr
WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr
CVE-2026-79977
8.2 High
-
zephyrproject zephyr
OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)
CVE-2026-19741
7.5 High
-
zephyrproject zephyr
Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer
CVE-2026-19947
5.3 Medium
-
zephyrproject zephyr
NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller
CVE-2026-79976
7.1 High
-
zephyrproject zephyr
Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length
CVE-2026-78119
6.3 Medium
-
zephyrproject zephyr
Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP
CVE-2026-78118
7.0 High
-
zephyrproject zephyr
Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air
CVE-2026-78117
4.2 Medium
-
zephyrproject zephyr
Out-of-bounds read in Bluetooth Classic A2DP codec information element handling
CVE-2026-18748
3.5 Low
-
zephyrproject zephyr
Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path
CVE-2026-78116
5.2 Medium
-
zephyrproject zephyr
PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode
CVE-2026-19676
7.8 High
-
zephyrproject zephyr
Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service
CVE-2026-77684
5.7 Medium
-
zephyrproject zephyr
Zephyr RTIO syscall verifier validates output parameters for read instead of write access
CVE-2026-19595
6.1 Medium
-
zephyrproject zephyr
Stack out-of-bounds write in the OSDP Control Panel reply parser
CVE-2026-76788
8.8 High
-
zephyrproject zephyr
NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum
CVE-2026-76787
5.9 Medium
-
zephyrproject zephyr
Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver
CVE-2026-75085
4.2 Medium
-
zephyrproject zephyr
Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length
CVE-2026-75084
6.8 Medium
-
zephyrproject zephyr
Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header
CVE-2026-19673
7.1 High
-
zephyrproject zephyr
Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver
CVE-2026-75083
5.9 Medium
-
zephyrproject zephyr
Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping
CVE-2026-19940
6.5 Medium
-
zephyrproject zephyr
Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption
CVE-2026-19939
6.3 Medium
-
zephyrproject zephyr
Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails
CVE-2026-19938
5.9 Medium
-
zephyrproject zephyr
Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses
CVE-2026-19937
5.7 Medium
-
zephyrproject zephyr
Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference
CVE-2026-19936
4.8 Medium
-
zephyrproject zephyr
Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
CVE-2026-19740
6.5 Medium
- Show olderLoading…