Skip to contentZephyrproject-rtos vulnerabilities
Newest
- zephyrproject zephyrPSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoSCVE-2026-107742.4 Low
- zephyrproject zephyrOut-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)CVE-2026-107735.4 Medium
- zephyrproject zephyrBluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic valuesCVE-2026-24116.5 Medium
- zephyrproject zephyrMissing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routersCVE-2026-106865.8 Medium
- zephyrproject zephyrUse-after-free of GATT subscribe params in Bluetooth host CCC-write response handlerCVE-2026-106857.6 High
- zephyrproject zephyrOut-of-bounds read in coredump shell when printing stored-dump target codeCVE-2026-106843.0 Low
- zephyrproject zephyrDesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)CVE-2026-106832.4 Low
- zephyrproject zephyrOut-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspaceCVE-2026-106826.6 Medium
- zephyrproject zephyrSMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slotCVE-2026-106816.5 Medium
- zephyrproject zephyrDivision by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem imageCVE-2026-70074.6 Medium
- zephyrproject zephyrOut-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflowCVE-2026-106807.6 High
- zephyrproject zephyrDivide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)CVE-2026-106793.3 Low
- zephyrproject zephyrNULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controllerCVE-2026-106788.1 High
- zephyrproject zephyrKernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource poolCVE-2026-106776.5 Medium
- zephyrproject zephyrBluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)CVE-2026-106754.3 Medium
- zephyrproject zephyrDoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabledCVE-2026-106745.5 Medium
- zephyrproject zephyrOut-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassemblyCVE-2026-106738.3 High
- zephyrproject zephyrUnterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)CVE-2026-106728.2 High
- zephyrproject zephyrUser thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)CVE-2026-106717.1 High
- zephyrproject zephyrUser-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifierCVE-2026-106705.5 Medium
- zephyrproject zephyrXtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validationCVE-2026-106697.8 High
- zephyrproject zephyrHost-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driverCVE-2026-106682.4 Low
- zephyrproject zephyrSMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threadsCVE-2026-106677.8 High
- zephyrproject zephyrStack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`CVE-2026-106668.1 High
- zephyrproject zephyrHeap buffer overflow on WireGuard receive path via unbounded incoming packet lengthCVE-2026-106657.4 High
- zephyrproject zephyrOut-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)CVE-2026-106645.0 Medium
- zephyrproject zephyrUse-after-free / double-free of the root USB device in the experimental USB host stackCVE-2026-106636.1 Medium
- zephyrproject zephyrShared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruptionCVE-2026-106606.4 Medium
- zephyrproject zephyrNULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resumeCVE-2026-106594.7 Medium
- zephyrproject zephyrOut-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)CVE-2026-106573.7 Low
- zephyrproject zephyrNULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlersCVE-2026-106564.6 Medium
- zephyrproject zephyrUse-after-free race in SNTP async client when closing the socket while the socket service is still polling itCVE-2026-106556.5 Medium
- zephyrproject zephyrRFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth ClassicCVE-2026-106543.1 Low
- zephyrproject zephyrNon-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unrefCVE-2026-106536.4 Medium
- zephyrproject zephyrOut-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packetsCVE-2026-92636.5 Medium
- zephyrproject zephyrOut-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)CVE-2026-106524.8 Medium
- zephyrproject zephyrNULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustionCVE-2026-106486.2 Medium
- zephyrproject zephyrPath traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file readCVE-2026-8023Public exploit7.5 High
- zephyrproject zephyrBroken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stackCVE-2026-76568.1 High
- zephyrproject zephyrDeadlock denial of service in USB CDC-NCM device class on TX enqueue failureCVE-2026-106475.3 Medium
- zephyrproject zephyrRemotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handlingCVE-2026-105936.5 Medium
- zephyrproject zephyrUse-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellationCVE-2026-106467.4 High
- zephyrproject zephyrOut-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte bufferCVE-2026-106444.2 Medium
- zephyrproject zephyrOut-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)CVE-2026-106438.7 High
- zephyrproject zephyrnet: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packetsCVE-2026-133517.5 High
- zephyrproject zephyrUnbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow controlCVE-2026-106426.5 Medium
- zephyrproject zephyrOut-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validationCVE-2026-106587.1 High
- zephyrproject zephyrOut-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)CVE-2026-106517.1 High
- zephyrproject zephyrOut-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem imageCVE-2026-106454.9 Medium
- zephyrproject zephyrOut-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)CVE-2026-106417.1 High
- Show moreLoading…