Zephyrproject
Page 2 of 3 — Zephyrproject CVEs from a corpus of 249, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8023 | High | 7.5 | 2026-06-29 | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabl… |
CVE-2026-7656 | High | 8.1 | 2026-06-29 | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that… |
CVE-2026-10648 | Medium | 6.2 | 2026-06-29 | mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for… |
CVE-2026-10647 | Medium | 5.3 | 2026-06-29 | The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_… |
CVE-2026-10646 | High | 7.4 | 2026-06-28 | Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo… |
CVE-2026-10644 | Medium | 4.2 | 2026-06-28 | The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c), used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchron… |
CVE-2026-10593 | Medium | 6.5 | 2026-06-28 | The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subs… |
CVE-2026-10643 | High | 8.7 | 2026-06-28 | Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffe… |
CVE-2026-13351 | High | 7.5 | 2026-06-25 | Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 pack… |
CVE-2026-10642 | Medium | 4.6 | 2026-06-24 | The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the interrupt-d… |
CVE-2026-10658 | High | 7.1 | 2026-06-23 | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from… |
CVE-2026-10651 | High | 7.1 | 2026-06-23 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute I… |
CVE-2026-10645 | Medium | 4.9 | 2026-06-23 | The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory block. ext2_f… |
CVE-2026-10641 | High | 7.1 | 2026-06-17 | Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. During Ser… |
CVE-2026-10640 | Medium | 4.2 | 2026-06-16 | Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-s… |
CVE-2026-10639 | Medium | 4.8 | 2026-06-16 | In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and… |
CVE-2026-10638 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and… |
CVE-2026-10637 | Medium | 5.9 | 2026-06-16 | subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network stack's ow… |
CVE-2026-10636 | Low | 3.7 | 2026-06-16 | In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/net/ip/igmp.c read the network interface back out of the packet via net_pkt_iface(pkt) after the pa… |
CVE-2026-10635 | Medium | 6.3 | 2026-06-16 | On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of… |
CVE-2026-10634 | Medium | 4.8 | 2026-06-15 | Zephyr's native TCP stack iterates the global connection list in net_tcp_foreach() (subsys/net/ip/tcp.c) using the SYS_SLIST_FOR_EACH_CONTAINER_SAFE macro, whi… |
CVE-2026-5068 | High | 7.6 | 2026-06-09 | A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enab… |
CVE-2026-5067 | Critical | 9.8 | 2026-06-09 | A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header… |
CVE-2026-5066 | Medium | 6.3 | 2026-06-04 | A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TL… |
CVE-2026-5589 | Medium | 6.3 | 2026-06-04 | An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling (subsys/bluetooth/mesh/solicitation.c) leads to an out-of-bounds write… |
CVE-2026-5071 | Medium | 6.1 | 2026-05-30 | The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendt… |
CVE-2026-5072 | Medium | 6.5 | 2026-05-22 | A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes. An attacker sends a… |
CVE-2026-1681 | Medium | 6.1 | 2026-05-12 | Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the sam… |
CVE-2026-1677 | Medium | 5.3 | 2026-05-11 | Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level… |
CVE-2026-5590 | Medium | 6.4 | 2026-04-05 | A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NU… |
CVE-2026-1679 | High | 7.3 | 2026-03-28 | The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, co… |
CVE-2026-4179 | Medium | 6.1 | 2026-03-16 | Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop. |
CVE-2026-0849 | Low | 3.8 | 2026-03-16 | Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus… |
CVE-2026-1678 | Critical | 9.4 | 2026-03-05 | dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the fin… |
CVE-2026-20435 | Medium | 4.6 | 2026-03-02 | In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has p… |
CVE-2025-20747 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-20746 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-7403 | High | 7.6 | 2025-09-19 | Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precis… |
CVE-2025-10458 | High | 7.6 | 2025-09-19 | Parameters are not validated or sanitized, and are later used in various internal operations. |
CVE-2025-10457 | Medium | 4.3 | 2025-09-19 | The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a conne… |
CVE-2025-10456 | High | 7.1 | 2025-09-19 | A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a fla… |
CVE-2025-20696 | Medium | 6.8 | 2025-08-04 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-2962 | High | 7.5 | 2025-06-24 | A denial-of-service issue in the dns implemenation could cause an infinite loop. |
CVE-2025-1675 | High | 8.2 | 2025-02-25 | The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough… |
CVE-2025-1674 | High | 8.2 | 2025-02-25 | A lack of input validation allows for out of bounds reads caused by malicious or malformed packets. |
CVE-2025-1673 | High | 8.2 | 2025-02-25 | A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation. |
CVE-2024-10395 | High | 8.6 | 2025-02-03 | No proper validation of the length of user input in http_server_get_content_type_from_extension. |
CVE-2024-8798 | High | 7.5 | 2024-12-16 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. |
CVE-2024-11263 | Critical | 9.3 | 2024-11-15 | When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is… |
CVE-2024-6444 | Medium | 6.3 | 2024-10-04 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. |
CVE-2024-6443 | Medium | 6.3 | 2024-10-04 | In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty. |
CVE-2024-6442 | Medium | 6.3 | 2024-10-04 | In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow. |
CVE-2024-6259 | High | 7.6 | 2024-09-13 | BT: HCI: adv_ext_report Improper discarding in adv_ext_report |
CVE-2024-6137 | High | 7.6 | 2024-09-13 | BT: Classic: SDP OOB access in get_att_search_list |
CVE-2024-6135 | High | 7.6 | 2024-09-13 | BT:Classic: Multiple missing buf length checks |
CVE-2024-5931 | Medium | 6.3 | 2024-09-13 | BT: Unchecked user input in bap_broadcast_assistant |
CVE-2024-6258 | Medium | 6.8 | 2024-09-13 | BT: Missing length checks of net_buf in rfcomm_handle_data |
CVE-2024-5754 | High | 8.2 | 2024-09-13 | BT: Encryption procedure host vulnerability |
CVE-2024-4785 | High | 7.6 | 2024-08-19 | BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero |
CVE-2024-3332 | Medium | 6.5 | 2024-07-03 | A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device |
CVE-2024-3077 | Medium | 6.8 | 2024-03-29 | An malicious BLE device can crash BLE victim device by sending malformed gatt packet |
CVE-2023-7060 | High | 8.6 | 2024-03-15 | Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination add… |
CVE-2023-6881 | High | 7.3 | 2024-02-29 | Possible buffer overflow in is_mount_point |
CVE-2024-1638 | High | 8.2 | 2024-02-19 | The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission… |
CVE-2023-6249 | High | 8.0 | 2024-02-18 | Signed to unsigned conversion esp32_ipm_send |
CVE-2023-5779 | Medium | 4.4 | 2024-02-18 | can: out of bounds in remove_rx_filter function |
CVE-2023-6749 | High | 8.0 | 2024-02-18 | Unchecked length coming from user input in settings shell |
CVE-2023-5055 | High | 8.3 | 2023-11-21 | Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. |
CVE-2023-4424 | High | 8.3 | 2023-11-21 | An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the vi… |
CVE-2023-5139 | Medium | 4.4 | 2023-10-26 | Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver |
CVE-2023-5753 | Medium | 6.3 | 2023-10-25 | Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c |
CVE-2023-4257 | High | 7.6 | 2023-10-13 | Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. |
CVE-2023-4263 | High | 7.6 | 2023-10-13 | Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver |
CVE-2023-5563 | High | 7.1 | 2023-10-13 | The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This result… |
CVE-2023-3725 | High | 7.6 | 2023-10-06 | Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem |
CVE-2023-5184 | High | 7.0 | 2023-09-27 | Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers. |
CVE-2023-4264 | High | 7.1 | 2023-09-27 | Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. |
CVE-2023-4260 | Medium | 6.3 | 2023-09-27 | Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. |
CVE-2023-4259 | High | 7.1 | 2023-09-26 | Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code. |
CVE-2023-4258 | High | 8.6 | 2023-09-25 | In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisio… |
CVE-2023-4265 | Medium | 6.4 | 2023-08-12 | Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_… |
CVE-2023-2234 | Medium | 6.8 | 2023-07-10 | Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host. |
CVE-2023-1902 | Medium | 5.9 | 2023-07-10 | The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to… |
CVE-2023-1901 | Medium | 5.9 | 2023-07-10 | The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller… |
CVE-2023-0359 | Medium | 5.9 | 2023-07-10 | A missing nullptr-check in handle_ra_input can cause a nullptr-deref. |
CVE-2023-0779 | Medium | 6.7 | 2023-05-30 | At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation i… |
CVE-2021-3329 | Critical | 9.6 | 2023-02-26 | Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack |
CVE-2023-0396 | Medium | 6.8 | 2023-01-25 | A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses. |
CVE-2022-3806 | Critical | 9.8 | 2023-01-25 | Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer. |
CVE-2023-0397 | Critical | 9.6 | 2023-01-19 | A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete. |
CVE-2021-3966 | Critical | 9.6 | 2023-01-11 | usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem. |
CVE-2022-0553 | Medium | 6.5 | 2023-01-11 | There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrie… |
CVE-2022-2993 | High | 8.6 | 2022-12-09 | There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet. |
CVE-2022-2741 | High | 8.2 | 2022-10-31 | The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN… |
CVE-2022-1841 | High | 7.2 | 2022-08-31 | In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero. |
CVE-2022-1042 | High | 8.2 | 2022-07-26 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
CVE-2022-1041 | High | 8.2 | 2022-07-26 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
CVE-2021-3435 | Medium | 4.0 | 2022-06-28 | Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zep… |
CVE-2021-3434 | Medium | 4.9 | 2022-06-28 | Stack based buffer overflow in le_ecred_conn_req(). Zephyr versions >= v2.5.0 Stack-based Buffer Overflow (CWE-121). For more information, see https://github.c… |
CVE-2021-3433 | Medium | 4.0 | 2022-06-28 | Invalid channel map in CONNECT_IND results to Deadlock. Zephyr versions >= v2.5.0 Improper Check or Handling of Exceptional Conditions (CWE-703). For more info… |