Skip to contentZephyrproject Zephyr vulnerabilities
- zephyrproject zephyrDouble-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error pathsCVE-2026-118945.9 Medium
- zephyrproject zephyrCross-thread FPU register leak on ARM when FPU enabled without register sharingCVE-2026-119853.6 Low
- zephyrproject zephyrDouble free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)CVE-2026-118935.9 Medium
- zephyrproject zephyrUpdateHub: race condition on shared context causes out-of-bounds write and DoSCVE-2026-118122.5 Low
- zephyrproject zephyrSocket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoSCVE-2026-118113.7 Low
- zephyrproject zephyrOut-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLSCVE-2026-87188.4 High
- zephyrproject zephyrUpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadataCVE-2026-118093.7 Low
- zephyrproject zephyrNULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)CVE-2026-118107.5 High
- zephyrproject zephyrMissing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and writeCVE-2026-117436.6 Medium
- zephyrproject zephyrUse-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlockCVE-2026-117423.6 Low
- zephyrproject zephyrUse-after-free in Bluetooth host ATT TX completion on disconnect mid-transferCVE-2026-113687.1 High
- zephyrproject zephyrHeap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response bodyCVE-2026-108498.2 High
- zephyrproject zephyrOut-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)CVE-2026-108487.0 High
- zephyrproject zephyrPSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoSCVE-2026-107742.4 Low
- zephyrproject zephyrOut-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)CVE-2026-107735.4 Medium
- zephyrproject zephyrBluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic valuesCVE-2026-24116.5 Medium
- zephyrproject zephyrMissing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routersCVE-2026-106865.8 Medium
- zephyrproject zephyrUse-after-free of GATT subscribe params in Bluetooth host CCC-write response handlerCVE-2026-106857.6 High
- zephyrproject zephyrOut-of-bounds read in coredump shell when printing stored-dump target codeCVE-2026-106843.0 Low
- zephyrproject zephyrDesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)CVE-2026-106832.4 Low
- zephyrproject zephyrOut-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspaceCVE-2026-106826.6 Medium
- zephyrproject zephyrSMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slotCVE-2026-106816.5 Medium
- zephyrproject zephyrDivision by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem imageCVE-2026-70074.6 Medium
- zephyrproject zephyrOut-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflowCVE-2026-106807.6 High
- zephyrproject zephyrDivide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)CVE-2026-106793.3 Low
- zephyrproject zephyrNULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controllerCVE-2026-106788.1 High
- zephyrproject zephyrKernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource poolCVE-2026-106776.5 Medium
- zephyrproject zephyrBluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)CVE-2026-106754.3 Medium
- zephyrproject zephyrDoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabledCVE-2026-106745.5 Medium
- zephyrproject zephyrOut-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassemblyCVE-2026-106738.3 High
- zephyrproject zephyrUnterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)CVE-2026-106728.2 High
- zephyrproject zephyrUser thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)CVE-2026-106717.1 High
- zephyrproject zephyrUser-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifierCVE-2026-106705.5 Medium
- zephyrproject zephyrXtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validationCVE-2026-106697.8 High
- zephyrproject zephyrHost-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driverCVE-2026-106682.4 Low
- zephyrproject zephyrSMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threadsCVE-2026-106677.8 High
- zephyrproject zephyrStack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`CVE-2026-106668.1 High
- zephyrproject zephyrHeap buffer overflow on WireGuard receive path via unbounded incoming packet lengthCVE-2026-106657.4 High
- zephyrproject zephyrOut-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)CVE-2026-106645.0 Medium
- zephyrproject zephyrUse-after-free / double-free of the root USB device in the experimental USB host stackCVE-2026-106636.1 Medium
- zephyrproject zephyrShared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruptionCVE-2026-106606.4 Medium
- zephyrproject zephyrNULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resumeCVE-2026-106594.7 Medium
- zephyrproject zephyrOut-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)CVE-2026-106573.7 Low
- zephyrproject zephyrNULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlersCVE-2026-106564.6 Medium
- zephyrproject zephyrUse-after-free race in SNTP async client when closing the socket while the socket service is still polling itCVE-2026-106556.5 Medium
- zephyrproject zephyrRFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth ClassicCVE-2026-106543.1 Low
- zephyrproject zephyrNon-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unrefCVE-2026-106536.4 Medium
- zephyrproject zephyrOut-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packetsCVE-2026-92636.5 Medium
- zephyrproject zephyrOut-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)CVE-2026-106524.8 Medium
- zephyrproject zephyrNULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustionCVE-2026-106486.2 Medium
- Show moreLoading…