Skip to contentZephyrproject-rtos Zephyr vulnerabilities
- zephyrproject zephyrKernel stack information disclosure in the charger_get_prop() system call handlerCVE-2026-198093.3 Low
- zephyrproject zephyrArbitrary supervisor-mode function pointer injection via charger_set_prop() syscall in the charger driver APICVE-2026-910077.8 High
- zephyrproject-rtos zephyrICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.cCVE-2026-1269576.9 Medium
- zephyrproject zephyrUART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel modeCVE-2026-908345.5 Medium
- zephyrproject zephyrSigned offset bypasses bounds check in simulated EEPROM driver, allowing out-of-bounds kernel memory read and write from user modeCVE-2026-908337.8 High
- zephyrproject zephyrBluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds writeCVE-2026-776858.3 High
- zephyrproject zephyrZephyr PTP: unvalidated Delay_Resp message interval lets an on-link peer wedge the PTP thread and flood the networkCVE-2026-870426.5 Medium
- zephyrproject zephyrOut-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer lengthCVE-2026-823919.1 Critical
- zephyrproject zephyrOut-of-bounds read in Bluetooth Host periodic advertising report reassembly due to unvalidated report lengthCVE-2026-908324.3 Medium
- zephyrproject zephyrNXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet dropCVE-2026-905917.5 High
- zephyrproject zephyrPermanent loss of transmit capability in the NXP ENET QoS Ethernet driver after an Ethernet link dropCVE-2026-905906.5 Medium
- zephyrproject zephyrMemory-mapped thread stack is never unmapped when a thread is aborted by another thread, exhausting kernel virtual address spaceCVE-2026-905895.5 Medium
- zephyrproject zephyrOut-of-bounds read in Zephyr HTTP client debug logging of response header fieldsCVE-2026-905883.7 Low
- zephyrproject zephyrNULL pointer dereference in the Zephyr USB host stack when a device reports zero configurationsCVE-2026-905874.6 Medium
- zephyrproject zephyrXtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writesCVE-2026-905867.8 High
- zephyrproject zephyrRenesas RA SCI UART driver: unacknowledged receive-error interrupt causes a permanent interrupt storm and CPU lockupCVE-2026-905854.6 Medium
- zephyrproject zephyrNULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frameCVE-2026-870457.5 High
- zephyrproject zephyrMemory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of serviceCVE-2026-870446.5 Medium
- zephyrproject zephyrsys_rand_get() silently returns an unwritten buffer when the entropy device is not readyCVE-2026-870434.8 Medium
- zephyrproject zephyrInverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memoryCVE-2026-870417.8 High
- zephyrproject zephyrBluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and writeCVE-2026-870408.3 High
- zephyrproject zephyrI2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to driversCVE-2026-870397.8 High
- zephyrproject zephyrTime-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user modeCVE-2026-870387.0 High
- zephyrproject zephyrUnvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memoryCVE-2026-165118.8 High
- zephyrproject zephyrBluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queueCVE-2026-850365.7 Medium
- zephyrproject zephyrUse-after-free via dynamically allocated message queue retained by the CAN RX filterCVE-2026-850358.8 High
- zephyrproject zephyrOut-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribersCVE-2026-850346.7 Medium
- zephyrproject zephyrBluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peerCVE-2026-850334.6 Medium
- zephyrproject zephyrUse-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progressCVE-2026-850324.8 Medium
- zephyrproject zephyrOut-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packetCVE-2026-829626.5 Medium
- zephyrproject zephyrUnvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user modeCVE-2026-829617.8 High
- zephyrproject zephyrCross-session AES key confusion in the Espressif ESP32 hardware crypto driverCVE-2026-823903.7 Low
- zephyrproject zephyrBluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereferenceCVE-2026-823896.5 Medium
- zephyrproject zephyrUse of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic hostCVE-2026-823885.3 Medium
- zephyrproject zephyrIPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret keyCVE-2026-197423.7 Low
- zephyrproject zephyrBluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responsesCVE-2026-810387.1 High
- zephyrproject zephyrBluetooth Host connection reservation leak when multiple connectable advertising sets share an identityCVE-2026-810394.3 Medium
- zephyrproject zephyrOut-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet sizeCVE-2026-799828.8 High
- zephyrproject zephyrDNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofingCVE-2026-799816.5 Medium
- zephyrproject zephyrPredictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNSCVE-2026-799805.6 Medium
- zephyrproject zephyrStale TLB entries after demand-paging page-out let arm64 user threads access reused physical framesCVE-2026-799797.8 High
- zephyrproject zephyrOut-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read pathCVE-2026-799783.6 Low
- zephyrproject zephyrWireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in ZephyrCVE-2026-799778.2 High
- zephyrproject zephyrOpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)CVE-2026-197417.5 High
- zephyrproject zephyrMissing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexerCVE-2026-199475.3 Medium
- zephyrproject zephyrNULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controllerCVE-2026-799767.1 High
- zephyrproject zephyrOut-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet lengthCVE-2026-781196.3 Medium
- zephyrproject zephyrRace condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMPCVE-2026-781187.0 High
- zephyrproject zephyrRace condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the airCVE-2026-781174.2 Medium
- zephyrproject zephyrOut-of-bounds read in Bluetooth Classic A2DP codec information element handlingCVE-2026-187483.5 Low
- Show olderLoading…