PatchTheCVEzephyr vulnerabilities and fixes
Recent CVEs affecting zephyr, with upgrade or downgrade steps. 12 tracked.
zephyr has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-08-04. Highest priority: CVE-2026-10849 (score 49/100).
- CVE-2026-10682 MEDIUM 6.6 UPGRADE The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c per
- CVE-2026-10681 MEDIUM 6.5 UPGRADE In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated
- CVE-2026-7007 MEDIUM 4.6 UPGRADE The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/
- CVE-2026-10683 LOW 2.4 UPGRADE In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full inter
- CVE-2026-10686 MEDIUM 5.8 UPGRADE Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit
- CVE-2026-10685 HIGH 7.6 UPGRADE The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt
- CVE-2026-11368 HIGH 7.1 UPGRADE The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its ow
- CVE-2026-2411 MEDIUM 6.5 UPGRADE Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declara
- CVE-2026-10773 MEDIUM 5.4 UPGRADE The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-eleme
- CVE-2026-10848 HIGH 7.0 UPGRADE The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/o
- CVE-2026-10774 LOW 2.4 UPGRADE Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown
- CVE-2026-10849 HIGH 8.2 UPGRADE The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the
FAQ
How do I fix zephyr vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zephyr being exploited right now?
None of the tracked zephyr CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zephyr CVE should I patch first?
CVE-2026-10849 currently ranks highest (49/100): The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the .