Skip to contentZephyrproject vulnerabilities
Newest
- zephyrproject zephyrUse-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)CVE-2026-106404.2 Medium
- zephyrproject zephyrUse-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`CVE-2026-106394.8 Medium
- zephyrproject zephyrUse-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or errorCVE-2026-106385.9 Medium
- zephyrproject zephyrUse-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD QueryCVE-2026-106375.9 Medium
- zephyrproject zephyrUse-after-free in Zephyr IPv4 IGMP send path (`igmp_send`)CVE-2026-106363.7 Low
- zephyrproject zephyrDangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-initCVE-2026-106356.3 Medium
- zephyrproject zephyrUse-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callbackCVE-2026-106344.8 Medium
- zephyrproject zephyrbt: l2cap le coc: remote oob write via seg counter stored in net_buf user_dataCVE-2026-50687.6 High
- zephyrproject zephyrOut-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-KeyCVE-2026-50679.8 Critical
- zephyrproject zephyrnet: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect functionCVE-2026-50666.3 Medium
- zephyrproject zephyrOut-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.CVE-2026-55896.3 Medium
- zephyrproject zephyrcan: Local Denial of Service via SocketCAN SendCVE-2026-50716.1 Medium
- zephyrproject zephyrptp: Potential Denial of Service via PTP Interval ShiftCVE-2026-50726.5 Medium
- zephyrproject zephyrnet: Stack Overflow with Ping (to own IP Address) via ShellCVE-2026-16816.1 Medium
- zephyrproject zephyrnet: TLS 1.2 connections allowed on TLS 1.3 socketsCVE-2026-16775.3 Medium
- zephyrproject zephyrnet: ip/tcp: Null pointer dereference can be triggered by a race conditionCVE-2026-55906.4 Medium
- zephyrproject zephyrnet: eswifi socket send payload length not boundedCVE-2026-16797.3 High
- zephyrproject zephyrstm32: usb: Infinite while loop in Interrupt HandlerCVE-2026-41796.1 Medium
- zephyrproject zephyrcrypto: ATAES132A response length allows stack buffer overflowCVE-2026-08493.8 Low
- zephyrproject zephyrdns: memory‑safety issue in the DNS name parserCVE-2026-16789.4 Critical
- google android, linuxfoundation yocto, mediatek, inc. mediatek chipset +3 more +5 moreIn preloader, there is a possible read of device unique identifiers due to a logic error. This...CVE-2026-20435Fix available4.6 Medium
- google android, linuxfoundation yocto, mediatek, inc. mt2718, mt2737, mt6835, mt6878, mt6886, mt6897, mt6899, mt6982, mt6985, mt6986, mt6986d, mt6989, mt6990, mt6991, mt8676, mt8678, mt8755, mt8893 +3 more +5 moreIn gnss service, there is a possible out of bounds write due to an incorrect bounds check. This...CVE-2025-207476.7 Medium
- google android, linuxfoundation yocto, mediatek, inc. mt2718, mt2737, mt6835, mt6878, mt6886, mt6897, mt6899, mt6982, mt6985, mt6986, mt6986d, mt6989, mt6990, mt6991, mt8676, mt8678, mt8755, mt8893 +3 more +5 moreIn gnss service, there is a possible out of bounds write due to an incorrect bounds check. This...CVE-2025-207466.7 Medium
- zephyrproject zephyrBluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requestsCVE-2025-104567.1 High
- zephyrproject zephyrBluetooth: le_conn_rsp does not sanitize CID, MTU, MPS valuesCVE-2025-104587.6 High
- zephyrproject zephyrBluetooth: bt_conn_tx_processor unsafe handlingCVE-2025-74037.6 High
- zephyrproject zephyrBluetooth: Out-Of-Context le_conn_rsp HandlingCVE-2025-104574.3 Medium
- google android, linuxfoundation yocto, mediatek, inc. mt6739, mt6761, mt6765, mt6768, mt6781, mt6789, mt6813, mt6833, mt6835, mt6853, mt6855, mt6877, mt6878, mt6879, mt6883, mt6885, mt6886, mt6889, mt6893, mt6895, mt6897, mt6899, mt6983, mt6985, mt6989, mt6990, mt6991, mt8188, mt8196, mt8370, mt8390, mt8676 +3 more +5 moreIn DA, there is a possible out of bounds write due to a missing bounds check. This could lead to...CVE-2025-20696Fix available6.8 Medium
- zephyrproject zephyrInfinite loop in dns_copy_qnameCVE-2025-29628.2 High
- zephyrproject zephyrOut of bounds read in dns_copy_qnameCVE-2025-16758.2 High
- zephyrproject zephyrOut of bounds read when unpacking DNS answersCVE-2025-16748.2 High
- zephyrproject zephyrOut of bounds read when calling crc16_ansi and strlen in dns_validate_msgCVE-2025-16738.2 High
- zephyrproject zephyrnet: lib: http_server: Buffer Under-readCVE-2024-103958.6 High
- zephyrproject zephyrBluetooth: classic: avdtp: missing buffer length checkCVE-2024-87987.5 High
- zephyrproject zephyrarch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=yCVE-2024-112639.4 Critical
- zephyrproject zephyrBluetooth: ots: missing buffer length checkCVE-2024-64446.3 Medium
- zephyrproject zephyrzephyr: out-of-bound read in utf8_truncCVE-2024-64436.3 Medium
- zephyrproject zephyrBluetooth: ASCS Unchecked tailroom of the response bufferCVE-2024-64426.3 Medium
- zephyrproject zephyrBT: HCI: adv_ext_report Improper discarding in adv_ext_reportCVE-2024-62597.6 High
- zephyrproject zephyrBT: Classic: SDP OOB access in get_att_search_listCVE-2024-61377.6 High
- zephyrproject zephyrBT: Unchecked user input in bap_broadcast_assistantCVE-2024-59316.3 Medium
- zephyrproject zephyrBT: Missing length checks of net_buf in rfcomm_handle_dataCVE-2024-62586.8 Medium
- zephyrproject zephyrBT: Encryption procedure host vulnerabilityCVE-2024-57548.2 High
- zephyrproject zephyrBT:Classic: Multiple missing buf length checksCVE-2024-61357.6 High
- zephyrproject zephyrBT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by ZeroCVE-2024-47857.6 High
- zephyrproject zephyrbt: host/smp: DoS caused by null pointer dereferenceCVE-2024-33326.5 Medium
- zephyrproject zephyrBluetooth: integer underflow in gatt_find_info_rspCVE-2024-30776.8 Medium
- zephyrproject zephyrMissing Security Control in Zephyr OS IP Packet HandlingCVE-2023-70608.6 High
- zephyrproject zephyrfs: fuse: buffer overflow vulnerability in the Zephyr FSCVE-2023-68817.3 High
- zephyrproject zephyrBluetooth characteristic LESC security requirement not enforced without additional flagsCVE-2024-16388.2 High
- Show moreLoading…