Skip to contentZephyrproject-rtos Zephyr vulnerabilities
- zephyrproject zephyrOut-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packetsCVE-2026-92636.5 Medium
- zephyrproject zephyrOut-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)CVE-2026-106524.8 Medium
- zephyrproject zephyrNULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustionCVE-2026-106486.2 Medium
- zephyrproject zephyrPath traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file readCVE-2026-8023Public exploit7.5 High
- zephyrproject zephyrBroken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stackCVE-2026-76568.1 High
- zephyrproject zephyrDeadlock denial of service in USB CDC-NCM device class on TX enqueue failureCVE-2026-106475.3 Medium
- zephyrproject zephyrRemotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handlingCVE-2026-105936.5 Medium
- zephyrproject zephyrUse-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellationCVE-2026-106467.4 High
- zephyrproject zephyrOut-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte bufferCVE-2026-106444.2 Medium
- zephyrproject zephyrOut-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)CVE-2026-106438.7 High
- zephyrproject zephyrnet: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packetsCVE-2026-133517.5 High
- zephyrproject zephyrUnbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow controlCVE-2026-106426.5 Medium
- zephyrproject zephyrOut-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validationCVE-2026-106587.1 High
- zephyrproject zephyrOut-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)CVE-2026-106517.1 High
- zephyrproject zephyrOut-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem imageCVE-2026-106454.9 Medium
- zephyrproject zephyrOut-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)CVE-2026-106417.1 High
- zephyrproject zephyrUse-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)CVE-2026-106404.2 Medium
- zephyrproject zephyrUse-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`CVE-2026-106394.8 Medium
- zephyrproject zephyrUse-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or errorCVE-2026-106385.9 Medium
- zephyrproject zephyrUse-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD QueryCVE-2026-106375.9 Medium
- zephyrproject zephyrUse-after-free in Zephyr IPv4 IGMP send path (`igmp_send`)CVE-2026-106363.7 Low
- zephyrproject zephyrDangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-initCVE-2026-106356.3 Medium
- zephyrproject zephyrUse-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callbackCVE-2026-106344.8 Medium
- zephyrproject zephyrbt: l2cap le coc: remote oob write via seg counter stored in net_buf user_dataCVE-2026-50687.6 High
- zephyrproject zephyrOut-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-KeyCVE-2026-50679.8 Critical
- zephyrproject zephyrnet: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect functionCVE-2026-50666.3 Medium
- zephyrproject zephyrOut-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.CVE-2026-55896.3 Medium
- zephyrproject zephyrcan: Local Denial of Service via SocketCAN SendCVE-2026-50716.1 Medium
- zephyrproject zephyrptp: Potential Denial of Service via PTP Interval ShiftCVE-2026-50726.5 Medium
- zephyrproject zephyrnet: Stack Overflow with Ping (to own IP Address) via ShellCVE-2026-16816.1 Medium
- zephyrproject zephyrnet: TLS 1.2 connections allowed on TLS 1.3 socketsCVE-2026-16775.3 Medium
- zephyrproject zephyrnet: ip/tcp: Null pointer dereference can be triggered by a race conditionCVE-2026-55906.4 Medium
- zephyrproject zephyrnet: eswifi socket send payload length not boundedCVE-2026-16797.3 High
- zephyrproject zephyrstm32: usb: Infinite while loop in Interrupt HandlerCVE-2026-41796.1 Medium
- zephyrproject zephyrcrypto: ATAES132A response length allows stack buffer overflowCVE-2026-08493.8 Low
- zephyrproject zephyrdns: memory‑safety issue in the DNS name parserCVE-2026-16789.4 Critical
- zephyrproject-rtos zephyrnet: icmp: Out of bound memory readCVE-2025-128996.5 Medium
- zephyrproject-rtos zephyrBluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAPCVE-2025-120356.5 Medium
- zephyrproject-rtos zephyrBluetooth: Mesh: Out-of-Bound Write in gen_prov_contCVE-2025-95577.6 High
- zephyrproject-rtos zephyrBluetooth: Mesh: Out-of-Bound Write in gen_prov_startCVE-2025-95587.6 High
- zephyrproject-rtos zephyrUserspace privilege escalation vulnerability on Cortex MCVE-2025-94088.2 High
- zephyrproject-rtos zephyrBluetooth: peripheral: Invalid handling of malformed connection requestCVE-2025-12890Public exploit6.5 Medium
- zephyrproject zephyrBluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requestsCVE-2025-104567.1 High
- zephyrproject zephyrBluetooth: le_conn_rsp does not sanitize CID, MTU, MPS valuesCVE-2025-104587.6 High
- zephyrproject zephyrBluetooth: bt_conn_tx_processor unsafe handlingCVE-2025-74037.6 High
- zephyrproject zephyrBluetooth: Out-Of-Context le_conn_rsp HandlingCVE-2025-104574.3 Medium
- zephyrproject zephyrInfinite loop in dns_copy_qnameCVE-2025-29628.2 High
- zephyrproject zephyrOut of bounds read in dns_copy_qnameCVE-2025-16758.2 High
- zephyrproject zephyrOut of bounds read when unpacking DNS answersCVE-2025-16748.2 High
- zephyrproject zephyrOut of bounds read when calling crc16_ansi and strlen in dns_validate_msgCVE-2025-16738.2 High
- Show moreLoading…