yocto vulnerabilities and fixes

Recent CVEs affecting yocto, with upgrade or downgrade steps. 141 tracked.

yocto has 141 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 8. Most recent: 2026-03-09. Highest priority: CVE-2024-25626 (score 53/100).

• CVE-2025-20746 MEDIUM 6.7 DOWNGRADE DOWNGRADE In gnss service, there is a possible out of bounds write due to an incorrect bounds check
• CVE-2025-20747 MEDIUM 6.7 DOWNGRADE DOWNGRADE In gnss service, there is a possible out of bounds write due to an incorrect bounds check
• CVE-2026-20435 MEDIUM 4.6 DOWNGRADE DOWNGRADE In preloader, there is a possible read of device unique identifiers due to a logic error
• CVE-2025-61611 HIGH 7.5 MITIGATE In modem, there is a possible improper input validation
• CVE-2025-20765 MEDIUM 4.7 DOWNGRADE MITIGATE In aee daemon, there is a possible system crash due to a race condition
• CVE-2025-20730 MEDIUM 6.7 DOWNGRADE DOWNGRADE In preloader, there is a possible escalation of privilege due to an insecure default value
• CVE-2025-20705 HIGH 7.8 DOWNGRADE MITIGATE In monitor_hang, there is a possible memory corruption due to use after free
• CVE-2025-20696 MEDIUM 6.8 DOWNGRADE DOWNGRADE In DA, there is a possible out of bounds write due to a missing bounds check
• CVE-2025-20693 MEDIUM 6.5 DOWNGRADE UPGRADE In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check
• CVE-2025-20656 MEDIUM 6.8 DOWNGRADE DOWNGRADE In DA, there is a possible out of bounds write due to a missing bounds check
• CVE-2025-20651 MEDIUM 4.1 DOWNGRADE DOWNGRADE In da, there is a possible out of bounds read due to a missing bounds check
• CVE-2025-20650 MEDIUM 6.8 DOWNGRADE DOWNGRADE In da, there is a possible out of bounds write due to a missing bounds check
• CVE-2025-20635 MEDIUM 6.6 DOWNGRADE DOWNGRADE In V6 DA, there is a possible out of bounds write due to a missing bounds check
• CVE-2024-25626 HIGH 8.8 UPGRADE Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems
• CVE-2024-20153 HIGH 7.5 DOWNGRADE UPGRADE In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID
• CVE-2024-20152 MEDIUM 4.4 DOWNGRADE UPGRADE In wlan STA driver, there is a possible reachable assertion due to improper exception handling
• CVE-2024-20148 CRITICAL 9.8 DOWNGRADE UPGRADE In wlan STA FW, there is a possible out of bounds write due to improper input validation
• CVE-2024-20147 MEDIUM 5.3 DOWNGRADE UPGRADE In Bluetooth FW, there is a possible reachable assertion due to improper exception handling
• CVE-2024-20146 HIGH 8.1 DOWNGRADE UPGRADE In wlan STA driver, there is a possible out of bounds write due to improper input validation
• CVE-2024-20145 MEDIUM 6.6 DOWNGRADE DOWNGRADE In V6 DA, there is a possible out of bounds write due to a missing bounds check
• CVE-2024-20144 MEDIUM 6.6 DOWNGRADE DOWNGRADE In V6 DA, there is a possible out of bounds write due to a missing bounds check
• CVE-2024-20143 MEDIUM 6.6 DOWNGRADE DOWNGRADE In V6 DA, there is a possible out of bounds write due to a missing bounds check
• CVE-2024-20140 MEDIUM 6.7 DOWNGRADE MITIGATE In power, there is a possible out of bounds write due to a missing bounds check
• CVE-2024-20139 MEDIUM 6.5 DOWNGRADE UPGRADE In Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions
• CVE-2024-20107 MEDIUM 6.2 DOWNGRADE DOWNGRADE In da, there is a possible out of bounds read due to a missing bounds check
• CVE-2024-20104 HIGH 8.4 DOWNGRADE DOWNGRADE In da, there is a possible out of bounds write due to a missing bounds check
• CVE-2024-20099 MEDIUM 6.7 DOWNGRADE MITIGATE In power, there is a possible out of bounds write due to a missing bounds check
• CVE-2024-20098 MEDIUM 6.7 DOWNGRADE MITIGATE In power, there is a possible out of bounds write due to a missing bounds check
• CVE-2024-20089 HIGH 7.5 DOWNGRADE DOWNGRADE In wlan, there is a possible denial of service due to incorrect error handling
• CVE-2024-20085 MEDIUM 4.4 DOWNGRADE DOWNGRADE In power, there is a possible out of bounds read due to a missing bounds check
• CVE-2024-20084 MEDIUM 4.4 DOWNGRADE DOWNGRADE In power, there is a possible out of bounds read due to a missing bounds check
• CVE-2024-20081 MEDIUM 6.7 DOWNGRADE DOWNGRADE In gnss service, there is a possible out of bounds write due to improper input validation
• CVE-2024-20080 CRITICAL 9.8 DOWNGRADE DOWNGRADE In gnss service, there is a possible escalation of privilege due to improper certificate validation
• CVE-2024-20055 MEDIUM 6.3 DOWNGRADE DOWNGRADE In imgsys, there is a possible information disclosure due to a missing bounds check
• CVE-2024-20054 MEDIUM 6.6 DOWNGRADE DOWNGRADE In gnss, there is a possible escalation of privilege due to a missing bounds check
• CVE-2024-20053 HIGH 8.4 DOWNGRADE DOWNGRADE In flashc, there is a possible out of bounds write due to an uncaught exception
• CVE-2024-20052 MEDIUM 4.4 DOWNGRADE DOWNGRADE In flashc, there is a possible information disclosure due to an uncaught exception
• CVE-2024-20051 LOW 2.3 DOWNGRADE DOWNGRADE In flashc, there is a possible system crash due to an uncaught exception
• CVE-2024-20050 MEDIUM 4.4 DOWNGRADE DOWNGRADE In flashc, there is a possible information disclosure due to an uncaught exception
• CVE-2024-20049 MEDIUM 4.4 DOWNGRADE DOWNGRADE In flashc, there is a possible information disclosure due to an uncaught exception
• CVE-2024-20040 HIGH 8.8 DOWNGRADE DOWNGRADE In wlan firmware, there is a possible out of bounds write due to improper input validation
• CVE-2024-20023 MEDIUM 6.7 DOWNGRADE DOWNGRADE In flashc, there is a possible out of bounds write due to lack of valudation
• CVE-2024-20022 MEDIUM 6.7 DOWNGRADE DOWNGRADE In lk, there is a possible escalation of privilege due to a missing bounds check
• CVE-2023-32871 MEDIUM 5.3 DOWNGRADE DOWNGRADE In DA, there is a possible permission bypass due to an incorrect status check
• CVE-2023-32855 MEDIUM 6.7 DOWNGRADE DOWNGRADE In aee, there is a possible escalation of privilege due to a missing permission check
• CVE-2023-32829 MEDIUM 6.7 DOWNGRADE DOWNGRADE In apusys, there is a possible out of bounds write due to an integer overflow
• CVE-2023-32820 HIGH 7.5 DOWNGRADE DOWNGRADE In wlan firmware, there is a possible firmware assertion due to improper input handling
• CVE-2023-32815 MEDIUM 4.4 DOWNGRADE MITIGATE In gnss service, there is a possible out of bounds read due to improper input validation
• CVE-2023-32813 MEDIUM 4.4 DOWNGRADE MITIGATE In gnss service, there is a possible out of bounds write due to improper input validation
• CVE-2023-32812 MEDIUM 6.7 DOWNGRADE MITIGATE In gnss service, there is a possible out of bounds write due to improper input validation
• CVE-2023-32811 MEDIUM 6.7 DOWNGRADE DOWNGRADE In connectivity system driver, there is a possible out of bounds write due to improper input validation
• CVE-2023-32810 MEDIUM 4.4 DOWNGRADE MITIGATE In bluetooth driver, there is a possible out of bounds read due to improper input validation
• CVE-2023-32807 MEDIUM 4.4 DOWNGRADE DOWNGRADE In wlan service, there is a possible out of bounds read due to improper input validation
• CVE-2023-32806 MEDIUM 6.7 DOWNGRADE DOWNGRADE In wlan driver, there is a possible out of bounds write due to improper input validation
• CVE-2023-20850 MEDIUM 6.5 DOWNGRADE DOWNGRADE In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking
• CVE-2023-20849 MEDIUM 6.5 DOWNGRADE DOWNGRADE In imgsys_cmdq, there is a possible use after free due to a missing valid range checking
• CVE-2023-20848 MEDIUM 6.5 DOWNGRADE DOWNGRADE In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking
• CVE-2023-20847 MEDIUM 4.2 DOWNGRADE DOWNGRADE In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking
• CVE-2023-20846 MEDIUM 4.2 DOWNGRADE DOWNGRADE In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking
• CVE-2023-20845 MEDIUM 4.2 DOWNGRADE DOWNGRADE In imgsys, there is a possible out of bounds read due to a missing valid range checking
• CVE-2023-20844 MEDIUM 4.2 DOWNGRADE DOWNGRADE In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking
• CVE-2023-20843 MEDIUM 4.2 DOWNGRADE DOWNGRADE In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking
• CVE-2023-20842 MEDIUM 6.5 DOWNGRADE DOWNGRADE In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking
• CVE-2023-20841 MEDIUM 6.5 DOWNGRADE DOWNGRADE In imgsys, there is a possible out of bounds write due to a missing valid range checking
• CVE-2023-20840 MEDIUM 6.5 DOWNGRADE DOWNGRADE In imgsys, there is a possible out of bounds read and write due to a missing valid range checking
• CVE-2023-20839 MEDIUM 4.2 DOWNGRADE DOWNGRADE In imgsys, there is a possible out of bounds read due to a missing valid range checking
• CVE-2023-20838 MEDIUM 4.0 DOWNGRADE MITIGATE In imgsys, there is a possible out of bounds read due to a race condition
• CVE-2023-20835 MEDIUM 6.4 DOWNGRADE DOWNGRADE In camsys, there is a possible use after free due to a race condition
• CVE-2023-20832 MEDIUM 6.7 DOWNGRADE DOWNGRADE In gps, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20831 MEDIUM 6.7 DOWNGRADE DOWNGRADE In gps, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20830 MEDIUM 6.7 DOWNGRADE DOWNGRADE In gps, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20829 MEDIUM 6.7 DOWNGRADE DOWNGRADE In gps, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20828 MEDIUM 6.7 DOWNGRADE DOWNGRADE In gps, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20821 MEDIUM 6.7 DOWNGRADE DOWNGRADE In nvram, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20805 MEDIUM 6.7 DOWNGRADE MITIGATE In imgsys, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20804 MEDIUM 6.7 DOWNGRADE MITIGATE In imgsys, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20803 MEDIUM 6.5 DOWNGRADE MITIGATE In imgsys, there is a possible memory corruption due to improper input validation
• CVE-2023-20802 MEDIUM 6.5 DOWNGRADE MITIGATE In imgsys, there is a possible memory corruption due to improper input validation
• CVE-2023-20801 MEDIUM 6.4 DOWNGRADE MITIGATE In imgsys, there is a possible use after free due to a race condition
• CVE-2023-20800 MEDIUM 6.5 DOWNGRADE MITIGATE In imgsys, there is a possible system crash due to a mssing ptr check
• CVE-2023-20796 MEDIUM 4.4 DOWNGRADE DOWNGRADE In power, there is a possible memory corruption due to an incorrect bounds check
• CVE-2023-20790 MEDIUM 4.4 DOWNGRADE DOWNGRADE In nvram, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20747 MEDIUM 4.4 DOWNGRADE DOWNGRADE In vcu, there is a possible memory corruption due to type confusion
• CVE-2023-20746 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible out of bounds write due to improper locking
• CVE-2023-20745 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible out of bounds write due to improper locking
• CVE-2023-20744 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible use after free due to a logic error
• CVE-2023-20743 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible out of bounds write due to improper locking
• CVE-2023-20740 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible memory corruption due to a logic error
• CVE-2023-20738 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20737 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible use after free due to improper locking
• CVE-2023-20736 MEDIUM 6.4 DOWNGRADE DOWNGRADE In vcu, there is a possible out of bounds write due to a race condition
• CVE-2023-20735 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20734 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20733 MEDIUM 6.7 DOWNGRADE DOWNGRADE In vcu, there is a possible use after free due to improper locking
• CVE-2023-20732 MEDIUM 6.7 DOWNGRADE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20731 MEDIUM 4.4 DOWNGRADE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20730 MEDIUM 4.4 DOWNGRADE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20729 MEDIUM 4.4 DOWNGRADE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20728 MEDIUM 4.4 DOWNGRADE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20727 MEDIUM 4.4 DOWNGRADE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20726 LOW 3.3 DOWNGRADE DOWNGRADE In mnld, there is a possible leak of GPS location due to a missing permission check
• CVE-2023-20721 MEDIUM 6.7 MITIGATE MITIGATE In isp, there is a possible out of bounds write due to improper input validation
• CVE-2023-20718 MEDIUM 6.7 MITIGATE MITIGATE In vcu, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20716 MEDIUM 6.7 DOWNGRADE DOWNGRADE In wlan, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20715 MEDIUM 6.7 DOWNGRADE DOWNGRADE In wlan, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20712 MEDIUM 6.7 DOWNGRADE DOWNGRADE In wlan, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20693 HIGH 7.5 DOWNGRADE MITIGATE In wlan firmware, there is possible system crash due to an uncaught exception
• CVE-2023-20692 HIGH 7.5 DOWNGRADE MITIGATE In wlan firmware, there is possible system crash due to an uncaught exception
• CVE-2023-20691 HIGH 7.5 DOWNGRADE MITIGATE In wlan firmware, there is possible system crash due to an integer overflow
• CVE-2023-20690 HIGH 7.5 DOWNGRADE MITIGATE In wlan firmware, there is possible system crash due to an integer overflow
• CVE-2023-20689 HIGH 7.5 DOWNGRADE MITIGATE In wlan firmware, there is possible system crash due to an integer overflow
• CVE-2023-20682 MEDIUM 6.7 MITIGATE MITIGATE In wlan, there is a possible out of bounds write due to an integer overflow
• CVE-2023-20679 MEDIUM 4.4 MITIGATE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20677 MEDIUM 4.4 MITIGATE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20676 MEDIUM 4.4 MITIGATE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20675 MEDIUM 4.4 MITIGATE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20674 MEDIUM 4.4 MITIGATE MITIGATE In wlan, there is a possible out of bounds read due to a missing bounds check
• CVE-2023-20663 MEDIUM 6.7 MITIGATE MITIGATE In wlan, there is a possible out of bounds write due to an integer overflow
• CVE-2023-20662 MEDIUM 6.7 MITIGATE MITIGATE In wlan, there is a possible out of bounds write due to an integer overflow
• CVE-2023-20661 MEDIUM 6.7 MITIGATE MITIGATE In wlan, there is a possible out of bounds write due to an integer overflow
• CVE-2023-20660 MEDIUM 4.4 MITIGATE MITIGATE In wlan, there is a possible out of bounds read due to an integer overflow
• CVE-2023-20659 MEDIUM 6.7 MITIGATE MITIGATE In wlan, there is a possible out of bounds write due to a missing bounds check
• CVE-2023-20623 MEDIUM 6.4 MITIGATE MITIGATE In ion, there is a possible escalation of privilege due to improper locking
• CVE-2022-32666 HIGH 7.5 DOWNGRADE MITIGATE In Wi-Fi, there is a possible low throughput due to misrepresentation of critical information
• CVE-2022-32659 MEDIUM 6.7 MITIGATE MITIGATE In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling
• CVE-2022-32633 MEDIUM 6.7 MITIGATE MITIGATE In Wi-Fi, there is a possible memory access violation due to a logic error
• CVE-2022-32632 MEDIUM 6.7 MITIGATE MITIGATE In Wi-Fi, there is a possible out of bounds write due to improper input validation
• CVE-2022-32631 MEDIUM 6.7 MITIGATE MITIGATE In Wi-Fi, there is a possible out of bounds write due to improper input validation
• CVE-2022-32592 MEDIUM 6.7 DOWNGRADE MITIGATE In cpu dvfs, there is a possible out of bounds write due to a missing bounds check
• CVE-2022-32590 MEDIUM 6.7 DOWNGRADE MITIGATE In wlan, there is a possible use after free due to an incorrect status check
• CVE-2022-32589 HIGH 7.5 DOWNGRADE MITIGATE In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release
• CVE-2022-26475 MEDIUM 6.7 DOWNGRADE MITIGATE In wlan, there is a possible out of bounds write due to a missing bounds check
• CVE-2022-26466 MEDIUM 6.7 MITIGATE MITIGATE In audio ipi, there is a possible out of bounds write due to an integer overflow
• CVE-2022-26465 MEDIUM 6.7 MITIGATE MITIGATE In audio ipi, there is a possible out of bounds write due to an incorrect bounds check
• CVE-2022-26447 CRITICAL 9.8 MITIGATE MITIGATE In BT firmware, there is a possible out of bounds write due to a missing bounds check
• CVE-2022-26435 MEDIUM 6.7 MITIGATE MITIGATE In mailbox, there is a possible out of bounds write due to type confusion
• CVE-2022-26434 MEDIUM 6.7 MITIGATE MITIGATE In mailbox, there is a possible out of bounds write due to a missing bounds check
• CVE-2022-26433 MEDIUM 6.7 MITIGATE MITIGATE In mailbox, there is a possible out of bounds write due to type confusion
• CVE-2022-26432 MEDIUM 6.7 MITIGATE MITIGATE In mailbox, there is a possible out of bounds write due to a missing bounds check
• CVE-2022-26431 MEDIUM 6.7 MITIGATE MITIGATE In mailbox, there is a possible out of bounds write due to a missing bounds check
• CVE-2022-26430 MEDIUM 6.7 MITIGATE MITIGATE In mailbox, there is a possible out of bounds write due to type confusion

FAQ

How do I fix yocto vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is yocto being exploited right now?

None of the tracked yocto CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which yocto CVE should I patch first?

CVE-2024-25626 currently ranks highest (53/100): Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems .

RSS feed for yocto · ← Back to latest CVEs