Zephyrproject Zephyr
249 CVEs affecting Zephyrproject Zephyr. Latest disclosed: 2026-09-14. Critical: 16, High: 87.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13214 | Critical | 9.8 | 2026-08-25 | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from th… |
CVE-2026-5067 | Critical | 9.8 | 2026-06-09 | A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header… |
CVE-2022-3806 | Critical | 9.8 | 2023-01-25 | Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer. |
CVE-2017-14199 | Critical | 9.8 | 2019-04-12 | A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0. |
CVE-2018-1000800 | Critical | 9.8 | 2018-09-06 | zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (er… |
CVE-2021-3329 | Critical | 9.6 | 2023-02-26 | Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack |
CVE-2023-0397 | Critical | 9.6 | 2023-01-19 | A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete. |
CVE-2021-3966 | Critical | 9.6 | 2023-01-11 | usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem. |
CVE-2021-3625 | Critical | 9.6 | 2021-10-05 | Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/… |
CVE-2026-1678 | Critical | 9.4 | 2026-03-05 | dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the fin… |
CVE-2024-11263 | Critical | 9.3 | 2024-11-15 | When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is… |
CVE-2020-13601 | Critical | 9.0 | 2021-05-25 | Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com… |
CVE-2020-10071 | Critical | 9.0 | 2020-06-05 | The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code exe… |
CVE-2020-10070 | Critical | 9.0 | 2020-06-05 | In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: z… |
CVE-2020-10062 | Critical | 9.0 | 2020-06-05 | An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue… |
CVE-2020-10022 | Critical | 9.0 | 2020-05-11 | A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in… |
CVE-2026-13212 | High | 8.8 | 2026-08-24 | The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virti… |
CVE-2026-12522 | High | 8.8 | 2026-08-19 | The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses the PDP-context dy… |
CVE-2026-9771 | High | 8.8 | 2026-08-17 | The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the ker… |
CVE-2026-12366 | High | 8.8 | 2026-08-14 | Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference cou… |