Skip to contentZephyrproject-rtos vulnerabilities
Newest
- zephyrproject zephyrSiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pktCVE-2026-143666.4 Medium
- zephyrproject zephyrWireGuard keepalive transport-data messages accepted without Poly1305 authenticationCVE-2026-137353.7 Low
- zephyrproject zephyrZephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijackCVE-2026-137346.5 Medium
- zephyrproject zephyrOut-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTPCVE-2026-134815.4 Medium
- zephyrproject zephyrOut-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handlerCVE-2026-134803.1 Low
- zephyrproject zephyrOut-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handlerCVE-2026-134793.1 Low
- zephyrproject zephyrOut-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_countCVE-2026-134785.5 Medium
- zephyrproject zephyrNULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoiCVE-2026-132175.9 Medium
- zephyrproject zephyrOut-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability lengthCVE-2026-132166.1 Medium
- zephyrproject zephyrZephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem imageCVE-2026-132156.8 Medium
- zephyrproject zephyrStack buffer overflow in OCPP GetConfiguration key parsingCVE-2026-132149.8 Critical
- zephyrproject zephyrBluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_registerCVE-2026-132135.3 Medium
- zephyrproject zephyrZephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor idCVE-2026-132128.8 High
- zephyrproject zephyrUninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responderCVE-2026-133435.3 Medium
- zephyrproject zephyrTOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memoryCVE-2026-97286.4 Medium
- zephyrproject zephyrInfineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustionCVE-2026-129995.3 Medium
- zephyrproject zephyrOut-of-bounds stack write in the settings NVS backend from over-reported nvs_read lengthCVE-2026-126345.3 Medium
- zephyrproject zephyrStack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fieldsCVE-2026-125228.8 High
- zephyrproject zephyrOut-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router AdvertisementCVE-2026-126338.1 High
- zephyrproject zephyrOut-of-bounds read in Zephyr PTP message parsing from unvalidated message typeCVE-2026-126326.5 Medium
- zephyrproject zephyrBroken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernelCVE-2026-126316.5 Medium
- zephyrproject zephyrStack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlersCVE-2026-125206.4 Medium
- zephyrproject zephyrOut-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsingCVE-2026-125195.0 Medium
- zephyrproject zephyrMissing device-pointer validation in flash_copy() syscall allows userspace privilege escalationCVE-2026-97718.8 High
- zephyrproject zephyr6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing modeCVE-2026-126304.3 Medium
- zephyrproject zephyrPL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of serviceCVE-2026-126294.6 Medium
- zephyrproject zephyrUse-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposalCVE-2026-123668.8 High
- zephyrproject zephyrUse-after-free in Zephyr delayable work-queue cancellation under SMP timing raceCVE-2026-123655.8 Medium
- zephyrproject zephyrMissing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of serviceCVE-2026-123648.4 High
- zephyrproject zephyrOut-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0CVE-2026-123634.2 Medium
- zephyrproject zephyrInfinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data lengthCVE-2026-122366.5 Medium
- zephyrproject zephyrOut-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)CVE-2026-122356.3 Medium
- zephyrproject zephyrTOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds writeCVE-2026-122347.8 High
- zephyrproject zephyrUninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contentionCVE-2026-122335.9 Medium
- zephyrproject zephyrOut-of-bounds read via unvalidated stream_id in Intel ALH DAI get_propertiesCVE-2026-122326.1 Medium
- zephyrproject zephyrOut-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the responseCVE-2026-120525.2 Medium
- zephyrproject zephyrNULL pointer dereference in USB DFU device_next download handler (handle_download)CVE-2026-120514.6 Medium
- zephyrproject zephyrDouble-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error pathsCVE-2026-118945.9 Medium
- zephyrproject zephyrCross-thread FPU register leak on ARM when FPU enabled without register sharingCVE-2026-119853.6 Low
- zephyrproject zephyrDouble free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)CVE-2026-118935.9 Medium
- zephyrproject zephyrUpdateHub: race condition on shared context causes out-of-bounds write and DoSCVE-2026-118122.5 Low
- zephyrproject zephyrSocket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoSCVE-2026-118113.7 Low
- zephyrproject zephyrOut-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLSCVE-2026-87188.4 High
- zephyrproject zephyrUpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadataCVE-2026-118093.7 Low
- zephyrproject zephyrNULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)CVE-2026-118107.5 High
- zephyrproject zephyrMissing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and writeCVE-2026-117436.6 Medium
- zephyrproject zephyrUse-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlockCVE-2026-117423.6 Low
- zephyrproject zephyrUse-after-free in Bluetooth host ATT TX completion on disconnect mid-transferCVE-2026-113687.1 High
- zephyrproject zephyrHeap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response bodyCVE-2026-108498.2 High
- zephyrproject zephyrOut-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)CVE-2026-108487.0 High
- Show moreLoading…