Skip to content
Zephyrproject Zephyr vulnerabilities
-
zephyrproject zephyr
UART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel mode
CVE-2026-90834
5.5 Medium
-
zephyrproject zephyr
Signed offset bypasses bounds check in simulated EEPROM driver, allowing out-of-bounds kernel memory read and write from user mode
CVE-2026-90833
7.8 High
-
zephyrproject zephyr
Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds write
CVE-2026-77685
8.3 High
-
zephyrproject zephyr
Zephyr PTP: unvalidated Delay_Resp message interval lets an on-link peer wedge the PTP thread and flood the network
CVE-2026-87042
6.5 Medium
-
zephyrproject zephyr
Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length
CVE-2026-82391
9.1 Critical
-
zephyrproject zephyr
Out-of-bounds read in Bluetooth Host periodic advertising report reassembly due to unvalidated report length
CVE-2026-90832
4.3 Medium
-
zephyrproject zephyr
NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop
CVE-2026-90591
7.5 High
-
zephyrproject zephyr
Permanent loss of transmit capability in the NXP ENET QoS Ethernet driver after an Ethernet link drop
CVE-2026-90590
6.5 Medium
-
zephyrproject zephyr
Memory-mapped thread stack is never unmapped when a thread is aborted by another thread, exhausting kernel virtual address space
CVE-2026-90589
5.5 Medium
-
zephyrproject zephyr
Out-of-bounds read in Zephyr HTTP client debug logging of response header fields
CVE-2026-90588
3.7 Low
-
zephyrproject zephyr
NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations
CVE-2026-90587
4.6 Medium
-
zephyrproject zephyr
Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes
CVE-2026-90586
7.8 High
-
zephyrproject zephyr
Renesas RA SCI UART driver: unacknowledged receive-error interrupt causes a permanent interrupt storm and CPU lockup
CVE-2026-90585
4.6 Medium
-
zephyrproject zephyr
NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame
CVE-2026-87045
7.5 High
-
zephyrproject zephyr
Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service
CVE-2026-87044
6.5 Medium
-
zephyrproject zephyr
sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready
CVE-2026-87043
4.8 Medium
-
zephyrproject zephyr
Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory
CVE-2026-87041
7.8 High
-
zephyrproject zephyr
Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write
CVE-2026-87040
8.3 High
-
zephyrproject zephyr
I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers
CVE-2026-87039
7.8 High
-
zephyrproject zephyr
Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode
CVE-2026-87038
7.0 High
-
zephyrproject zephyr
Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
CVE-2026-16511
8.8 High
-
zephyrproject zephyr
Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue
CVE-2026-85036
5.7 Medium
-
zephyrproject zephyr
Use-after-free via dynamically allocated message queue retained by the CAN RX filter
CVE-2026-85035
8.8 High
-
zephyrproject zephyr
Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers
CVE-2026-85034
6.7 Medium
-
zephyrproject zephyr
Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer
CVE-2026-85033
4.6 Medium
-
zephyrproject zephyr
Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress
CVE-2026-85032
4.8 Medium
-
zephyrproject zephyr
Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet
CVE-2026-82962
6.5 Medium
-
zephyrproject zephyr
Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode
CVE-2026-82961
7.8 High
-
zephyrproject zephyr
Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver
CVE-2026-82390
3.7 Low
-
zephyrproject zephyr
Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference
CVE-2026-82389
6.5 Medium
-
zephyrproject zephyr
Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host
CVE-2026-82388
5.3 Medium
-
zephyrproject zephyr
IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key
CVE-2026-19742
3.7 Low
-
zephyrproject zephyr
Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses
CVE-2026-81038
7.1 High
-
zephyrproject zephyr
Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity
CVE-2026-81039
4.3 Medium
-
zephyrproject zephyr
Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size
CVE-2026-79982
8.8 High
-
zephyrproject zephyr
DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing
CVE-2026-79981
6.5 Medium
-
zephyrproject zephyr
Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS
CVE-2026-79980
5.6 Medium
-
zephyrproject zephyr
Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames
CVE-2026-79979
7.8 High
-
zephyrproject zephyr
Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path
CVE-2026-79978
3.6 Low
-
zephyrproject zephyr
WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr
CVE-2026-79977
8.2 High
-
zephyrproject zephyr
OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)
CVE-2026-19741
7.5 High
-
zephyrproject zephyr
Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer
CVE-2026-19947
5.3 Medium
-
zephyrproject zephyr
NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller
CVE-2026-79976
7.1 High
-
zephyrproject zephyr
Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length
CVE-2026-78119
6.3 Medium
-
zephyrproject zephyr
Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP
CVE-2026-78118
7.0 High
-
zephyrproject zephyr
Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air
CVE-2026-78117
4.2 Medium
-
zephyrproject zephyr
Out-of-bounds read in Bluetooth Classic A2DP codec information element handling
CVE-2026-18748
3.5 Low
-
zephyrproject zephyr
Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path
CVE-2026-78116
5.2 Medium
-
zephyrproject zephyr
PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode
CVE-2026-19676
7.8 High
-
zephyrproject zephyr
Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service
CVE-2026-77684
5.7 Medium
- Show olderLoading…