Skip to contentZephyrproject Zephyr vulnerabilities
- zephyrproject zephyrPath traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file readCVE-2026-8023Public exploit7.5 High
- zephyrproject zephyrBroken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stackCVE-2026-76568.1 High
- zephyrproject zephyrDeadlock denial of service in USB CDC-NCM device class on TX enqueue failureCVE-2026-106475.3 Medium
- zephyrproject zephyrRemotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handlingCVE-2026-105936.5 Medium
- zephyrproject zephyrUse-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellationCVE-2026-106467.4 High
- zephyrproject zephyrOut-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte bufferCVE-2026-106444.2 Medium
- zephyrproject zephyrOut-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)CVE-2026-106438.7 High
- zephyrproject zephyrnet: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packetsCVE-2026-133517.5 High
- zephyrproject zephyrUnbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow controlCVE-2026-106426.5 Medium
- zephyrproject zephyrOut-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validationCVE-2026-106587.1 High
- zephyrproject zephyrOut-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)CVE-2026-106517.1 High
- zephyrproject zephyrOut-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem imageCVE-2026-106454.9 Medium
- zephyrproject zephyrOut-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)CVE-2026-106417.1 High
- zephyrproject zephyrUse-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)CVE-2026-106404.2 Medium
- zephyrproject zephyrUse-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`CVE-2026-106394.8 Medium
- zephyrproject zephyrUse-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or errorCVE-2026-106385.9 Medium
- zephyrproject zephyrUse-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD QueryCVE-2026-106375.9 Medium
- zephyrproject zephyrUse-after-free in Zephyr IPv4 IGMP send path (`igmp_send`)CVE-2026-106363.7 Low
- zephyrproject zephyrDangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-initCVE-2026-106356.3 Medium
- zephyrproject zephyrUse-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callbackCVE-2026-106344.8 Medium
- zephyrproject zephyrbt: l2cap le coc: remote oob write via seg counter stored in net_buf user_dataCVE-2026-50687.6 High
- zephyrproject zephyrOut-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-KeyCVE-2026-50679.8 Critical
- zephyrproject zephyrnet: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect functionCVE-2026-50666.3 Medium
- zephyrproject zephyrOut-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.CVE-2026-55896.3 Medium
- zephyrproject zephyrcan: Local Denial of Service via SocketCAN SendCVE-2026-50716.1 Medium
- zephyrproject zephyrptp: Potential Denial of Service via PTP Interval ShiftCVE-2026-50726.5 Medium
- zephyrproject zephyrnet: Stack Overflow with Ping (to own IP Address) via ShellCVE-2026-16816.1 Medium
- zephyrproject zephyrnet: TLS 1.2 connections allowed on TLS 1.3 socketsCVE-2026-16775.3 Medium
- zephyrproject zephyrnet: ip/tcp: Null pointer dereference can be triggered by a race conditionCVE-2026-55906.4 Medium
- zephyrproject zephyrnet: eswifi socket send payload length not boundedCVE-2026-16797.3 High
- zephyrproject zephyrstm32: usb: Infinite while loop in Interrupt HandlerCVE-2026-41796.1 Medium
- zephyrproject zephyrcrypto: ATAES132A response length allows stack buffer overflowCVE-2026-08493.8 Low
- zephyrproject zephyrdns: memory‑safety issue in the DNS name parserCVE-2026-16789.4 Critical
- google android, linuxfoundation yocto, mediatek, inc. mediatek chipset +3 more +5 moreIn preloader, there is a possible read of device unique identifiers due to a logic error. This...CVE-2026-20435Fix available4.6 Medium
- google android, linuxfoundation yocto, mediatek, inc. mt2718, mt2737, mt6835, mt6878, mt6886, mt6897, mt6899, mt6982, mt6985, mt6986, mt6986d, mt6989, mt6990, mt6991, mt8676, mt8678, mt8755, mt8893 +3 more +5 moreIn gnss service, there is a possible out of bounds write due to an incorrect bounds check. This...CVE-2025-207476.7 Medium
- google android, linuxfoundation yocto, mediatek, inc. mt2718, mt2737, mt6835, mt6878, mt6886, mt6897, mt6899, mt6982, mt6985, mt6986, mt6986d, mt6989, mt6990, mt6991, mt8676, mt8678, mt8755, mt8893 +3 more +5 moreIn gnss service, there is a possible out of bounds write due to an incorrect bounds check. This...CVE-2025-207466.7 Medium
- zephyrproject zephyrBluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requestsCVE-2025-104567.1 High
- zephyrproject zephyrBluetooth: le_conn_rsp does not sanitize CID, MTU, MPS valuesCVE-2025-104587.6 High
- zephyrproject zephyrBluetooth: bt_conn_tx_processor unsafe handlingCVE-2025-74037.6 High
- zephyrproject zephyrBluetooth: Out-Of-Context le_conn_rsp HandlingCVE-2025-104574.3 Medium
- google android, linuxfoundation yocto, mediatek, inc. mt6739, mt6761, mt6765, mt6768, mt6781, mt6789, mt6813, mt6833, mt6835, mt6853, mt6855, mt6877, mt6878, mt6879, mt6883, mt6885, mt6886, mt6889, mt6893, mt6895, mt6897, mt6899, mt6983, mt6985, mt6989, mt6990, mt6991, mt8188, mt8196, mt8370, mt8390, mt8676 +3 more +5 moreIn DA, there is a possible out of bounds write due to a missing bounds check. This could lead to...CVE-2025-20696Fix available6.8 Medium
- zephyrproject zephyrInfinite loop in dns_copy_qnameCVE-2025-29628.2 High
- zephyrproject zephyrOut of bounds read in dns_copy_qnameCVE-2025-16758.2 High
- zephyrproject zephyrOut of bounds read when unpacking DNS answersCVE-2025-16748.2 High
- zephyrproject zephyrOut of bounds read when calling crc16_ansi and strlen in dns_validate_msgCVE-2025-16738.2 High
- zephyrproject zephyrnet: lib: http_server: Buffer Under-readCVE-2024-103958.6 High
- zephyrproject zephyrBluetooth: classic: avdtp: missing buffer length checkCVE-2024-87987.5 High
- zephyrproject zephyrarch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=yCVE-2024-112639.4 Critical
- zephyrproject zephyrBluetooth: ots: missing buffer length checkCVE-2024-64446.3 Medium
- zephyrproject zephyrzephyr: out-of-bound read in utf8_truncCVE-2024-64436.3 Medium
- Show moreLoading…