CVEs published by Zephyr Project

CVEs published by Zephyr Project (CVE Numbering Authority). 46 tracked.

• CVE-2026-10686 MEDIUM 5.8 UPGRADE Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit
• CVE-2026-10685 HIGH 7.6 UPGRADE The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt
• CVE-2026-11368 HIGH 7.1 UPGRADE The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its ow
• CVE-2026-2411 MEDIUM 6.5 UPGRADE Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declara
• CVE-2026-10773 MEDIUM 5.4 UPGRADE The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-eleme
• CVE-2026-79976 HIGH 7.1 The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-regis
• CVE-2026-78119 MEDIUM 6.3 The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/esp
• CVE-2026-78118 HIGH 7.0 The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP s
• CVE-2026-78117 MEDIUM 4.2 The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing H
• CVE-2026-78116 MEDIUM 5.2 The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evalua
• CVE-2026-19947 MEDIUM 5.3 The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_g
• CVE-2026-19676 HIGH 7.8 The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handle
• CVE-2026-18748 LOW 3.5 The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte
• CVE-2026-10848 HIGH 7.0 UPGRADE The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/o
• CVE-2026-10774 LOW 2.4 UPGRADE Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown
• CVE-2026-10849 HIGH 8.2 UPGRADE The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the
• CVE-2026-79982 HIGH 8.8 The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copi
• CVE-2026-79981 MEDIUM 6.5 The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the reso
• CVE-2026-79980 MEDIUM 5.6 The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv
• CVE-2026-79979 HIGH 7.8 The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm
• CVE-2026-79978 LOW 3.6 The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345
• CVE-2026-79977 HIGH 8.2 The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could n
• CVE-2026-19741 HIGH 7.5 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthr
• CVE-2026-12233 MEDIUM 5.9 The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declar
• CVE-2026-12234 HIGH 7.8 The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/so
• CVE-2026-11743 MEDIUM 6.6 The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset an
• CVE-2026-12235 MEDIUM 6.3 The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relo
• CVE-2026-12232 MEDIUM 6.1 The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c
• CVE-2026-11742 LOW 3.6 The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q
• CVE-2026-11810 HIGH 7.5 The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updateh
• CVE-2026-8718 HIGH 8.4 tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(
• CVE-2026-11811 LOW 3.7 The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the
• CVE-2026-11809 LOW 3.7 The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory
• CVE-2026-11893 MEDIUM 5.9 The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drive
• CVE-2026-11894 MEDIUM 5.9 The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, vi
• CVE-2026-12052 MEDIUM 5.2 The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usb
• CVE-2026-12051 MEDIUM 4.6 The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL p
• CVE-2026-11985 LOW 3.6 On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which d
• CVE-2026-11812 LOW 2.5 The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a
• CVE-2026-12236 MEDIUM 6.5 The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an A
• CVE-2026-9771 HIGH 8.8 The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c
• CVE-2026-12519 MEDIUM 5.0 The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/m
• CVE-2026-12629 MEDIUM 4.6 The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts
• CVE-2026-12630 MEDIUM 4.3 Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_in
• CVE-2026-12632 MEDIUM 6.5 Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-b
• CVE-2026-12631 MEDIUM 6.5 The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in inclu

← Back to latest CVEs