Zephyrproject
Page 3 of 4 — Zephyrproject CVEs from a corpus of 322, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1681 | Medium | 6.1 | 2026-05-12 | Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the sam… |
CVE-2026-1677 | Medium | 5.3 | 2026-05-11 | Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level… |
CVE-2026-5590 | Medium | 6.4 | 2026-04-05 | A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NU… |
CVE-2026-1679 | High | 7.3 | 2026-03-28 | The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, co… |
CVE-2026-4179 | Medium | 6.1 | 2026-03-16 | Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop. |
CVE-2026-0849 | Low | 3.8 | 2026-03-16 | Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus… |
CVE-2026-1678 | Critical | 9.4 | 2026-03-05 | dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the fin… |
CVE-2026-20435 | Medium | 4.6 | 2026-03-02 | In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has p… |
CVE-2025-20747 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-20746 | Medium | 6.7 | 2025-11-04 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious acto… |
CVE-2025-7403 | High | 7.6 | 2025-09-19 | Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precis… |
CVE-2025-10458 | High | 7.6 | 2025-09-19 | Parameters are not validated or sanitized, and are later used in various internal operations. |
CVE-2025-10457 | Medium | 4.3 | 2025-09-19 | The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a conne… |
CVE-2025-10456 | High | 7.1 | 2025-09-19 | A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a fla… |
CVE-2025-20696 | Medium | 6.8 | 2025-08-04 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-2962 | High | 7.5 | 2025-06-24 | A denial-of-service issue in the dns implemenation could cause an infinite loop. |
CVE-2025-1675 | High | 8.2 | 2025-02-25 | The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough… |
CVE-2025-1674 | High | 8.2 | 2025-02-25 | A lack of input validation allows for out of bounds reads caused by malicious or malformed packets. |
CVE-2025-1673 | High | 8.2 | 2025-02-25 | A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation. |
CVE-2024-10395 | High | 8.6 | 2025-02-03 | No proper validation of the length of user input in http_server_get_content_type_from_extension. |
CVE-2024-8798 | High | 7.5 | 2024-12-16 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. |
CVE-2024-11263 | Critical | 9.3 | 2024-11-15 | When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is… |
CVE-2024-6444 | Medium | 6.3 | 2024-10-04 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. |
CVE-2024-6443 | Medium | 6.3 | 2024-10-04 | In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty. |
CVE-2024-6442 | Medium | 6.3 | 2024-10-04 | In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow. |
CVE-2024-6259 | High | 7.6 | 2024-09-13 | BT: HCI: adv_ext_report Improper discarding in adv_ext_report |
CVE-2024-6137 | High | 7.6 | 2024-09-13 | BT: Classic: SDP OOB access in get_att_search_list |
CVE-2024-6135 | High | 7.6 | 2024-09-13 | BT:Classic: Multiple missing buf length checks |
CVE-2024-5931 | Medium | 6.3 | 2024-09-13 | BT: Unchecked user input in bap_broadcast_assistant |
CVE-2024-6258 | Medium | 6.8 | 2024-09-13 | BT: Missing length checks of net_buf in rfcomm_handle_data |
CVE-2024-5754 | High | 8.2 | 2024-09-13 | BT: Encryption procedure host vulnerability |
CVE-2024-4785 | High | 7.6 | 2024-08-19 | BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero |
CVE-2024-3332 | Medium | 6.5 | 2024-07-03 | A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device |
CVE-2024-3077 | Medium | 6.8 | 2024-03-29 | An malicious BLE device can crash BLE victim device by sending malformed gatt packet |
CVE-2023-7060 | High | 8.6 | 2024-03-15 | Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination add… |
CVE-2023-6881 | High | 7.3 | 2024-02-29 | Possible buffer overflow in is_mount_point |
CVE-2024-1638 | High | 8.2 | 2024-02-19 | The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission… |
CVE-2023-6249 | High | 8.0 | 2024-02-18 | Signed to unsigned conversion esp32_ipm_send |
CVE-2023-5779 | Medium | 4.4 | 2024-02-18 | can: out of bounds in remove_rx_filter function |
CVE-2023-6749 | High | 8.0 | 2024-02-18 | Unchecked length coming from user input in settings shell |
CVE-2023-5055 | High | 8.3 | 2023-11-21 | Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. |
CVE-2023-4424 | High | 8.3 | 2023-11-21 | An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the vi… |
CVE-2023-5139 | Medium | 4.4 | 2023-10-26 | Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver |
CVE-2023-5753 | Medium | 6.3 | 2023-10-25 | Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c |
CVE-2023-4257 | High | 7.6 | 2023-10-13 | Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. |
CVE-2023-4263 | High | 7.6 | 2023-10-13 | Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver |
CVE-2023-5563 | High | 7.1 | 2023-10-13 | The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This result… |
CVE-2023-3725 | High | 7.6 | 2023-10-06 | Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem |
CVE-2023-5184 | High | 7.0 | 2023-09-27 | Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers. |
CVE-2023-4264 | High | 7.1 | 2023-09-27 | Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. |
CVE-2023-4260 | Medium | 6.3 | 2023-09-27 | Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. |
CVE-2023-4259 | High | 7.1 | 2023-09-26 | Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code. |
CVE-2023-4258 | High | 8.6 | 2023-09-25 | In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisio… |
CVE-2023-4265 | Medium | 6.4 | 2023-08-12 | Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_… |
CVE-2023-2234 | Medium | 6.8 | 2023-07-10 | Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host. |
CVE-2023-1902 | Medium | 5.9 | 2023-07-10 | The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to… |
CVE-2023-1901 | Medium | 5.9 | 2023-07-10 | The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller… |
CVE-2023-0359 | Medium | 5.9 | 2023-07-10 | A missing nullptr-check in handle_ra_input can cause a nullptr-deref. |
CVE-2023-0779 | Medium | 6.7 | 2023-05-30 | At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation i… |
CVE-2021-3329 | Critical | 9.6 | 2023-02-26 | Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack |
CVE-2023-0396 | Medium | 6.8 | 2023-01-25 | A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses. |
CVE-2022-3806 | Critical | 9.8 | 2023-01-25 | Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer. |
CVE-2023-0397 | Critical | 9.6 | 2023-01-19 | A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete. |
CVE-2021-3966 | Critical | 9.6 | 2023-01-11 | usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem. |
CVE-2022-0553 | Medium | 6.5 | 2023-01-11 | There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrie… |
CVE-2022-2993 | High | 8.6 | 2022-12-09 | There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet. |
CVE-2022-2741 | High | 8.2 | 2022-10-31 | The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN… |
CVE-2022-1841 | High | 7.2 | 2022-08-31 | In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero. |
CVE-2022-1042 | High | 8.2 | 2022-07-26 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
CVE-2022-1041 | High | 8.2 | 2022-07-26 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
CVE-2021-3435 | Medium | 4.0 | 2022-06-28 | Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zep… |
CVE-2021-3434 | Medium | 4.9 | 2022-06-28 | Stack based buffer overflow in le_ecred_conn_req(). Zephyr versions >= v2.5.0 Stack-based Buffer Overflow (CWE-121). For more information, see https://github.c… |
CVE-2021-3433 | Medium | 4.0 | 2022-06-28 | Invalid channel map in CONNECT_IND results to Deadlock. Zephyr versions >= v2.5.0 Improper Check or Handling of Exceptional Conditions (CWE-703). For more info… |
CVE-2021-3432 | Medium | 4.3 | 2022-06-28 | Invalid interval in CONNECT_IND leads to Division by Zero. Zephyr versions >= v1.14.0 Divide By Zero (CWE-369). For more information, see https://github.com/ze… |
CVE-2021-3431 | Medium | 4.3 | 2022-06-28 | Assertion reachable with repeated LL_FEATURE_REQ. Zephyr versions >= v2.5.0 contain Reachable Assertion (CWE-617). For more information, see https://github.com… |
CVE-2021-3430 | Medium | 6.5 | 2022-06-28 | Assertion reachable with repeated LL_CONNECTION_PARAM_REQ. Zephyr versions >= v1.14 contain Reachable Assertion (CWE-617). For more information, see https://gi… |
CVE-2021-3861 | High | 8.2 | 2022-02-07 | The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more informati… |
CVE-2021-3835 | High | 8.2 | 2022-02-07 | Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephy… |
CVE-2021-3455 | Medium | 4.3 | 2021-10-19 | Disconnecting L2CAP channel right after invalid ATT request leads freeze. Zephyr versions >= 2.4.0, >= 2.5.0 contain Use After Free (CWE-416). For more informa… |
CVE-2021-3454 | Medium | 4.3 | 2021-10-19 | Truncated L2CAP K-frame causes assertion failure. Zephyr versions >= 2.4.0, >= v.2.50 contain Improper Handling of Length Parameter Inconsistency (CWE-130), Re… |
CVE-2021-3330 | High | 7.1 | 2021-10-12 | RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr. Zephyr versions >= >=2.4.0 contain Out-o… |
CVE-2021-3323 | High | 8.3 | 2021-10-12 | Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Zephyr versions >= >=2.4.0 contain Integer Underflow (Wrap or Wraparound) (CWE-191). For more… |
CVE-2021-3322 | Medium | 6.5 | 2021-10-12 | Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions >= >=2.4.0 contain NULL Pointer Dereference (CWE-476). For more infor… |
CVE-2021-3321 | High | 7.5 | 2021-10-12 | Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions >= >=2.4.0 contain Integer Overflow to Buffer Overflow (CWE-680)… |
CVE-2021-3625 | Critical | 9.6 | 2021-10-05 | Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/… |
CVE-2021-3581 | High | 7.0 | 2021-10-05 | Buffer Access with Incorrect Length Value in zephyr. Zephyr versions >= >=2.5.0 contain Buffer Access with Incorrect Length Value (CWE-805). For more informati… |
CVE-2021-3510 | High | 7.5 | 2021-10-05 | Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access Child of a Non-structure Pointer (CWE-5… |
CVE-2021-3436 | Medium | 4.3 | 2021-10-05 | BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known. Zephyr versions >= 1.14.2, >= 2.4.0… |
CVE-2021-3319 | Medium | 6.5 | 2021-10-05 | DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Zephyr versions >= > v2.4.0 contain NULL Pointer Dereference (CWE-476), Attempt to… |
CVE-2021-3320 | Medium | 5.9 | 2021-05-25 | Type Confusion in 802154 ACK Frames Handling. Zephyr versions >= v2.4.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.co… |
CVE-2020-13603 | Medium | 6.9 | 2021-05-25 | Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For more information, se… |
CVE-2020-13602 | Medium | 4.0 | 2021-05-25 | Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with Unreachable Exit C… |
CVE-2020-13601 | Critical | 9.0 | 2021-05-25 | Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com… |
CVE-2020-13600 | High | 7.0 | 2021-05-25 | Malformed SPI in response for eswifi can corrupt kernel memory. Zephyr versions >= 1.14.2, >= 2.3.0 contain Heap-based Buffer Overflow (CWE-122). For more info… |
CVE-2020-13599 | Low | 3.3 | 2021-05-25 | Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more information, see htt… |
CVE-2020-13598 | Medium | 6.3 | 2021-05-25 | FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat. Zephyr versions >= v1.14.2, >= v2.3.0 contain Stack-based Buffer Overflow (CWE… |
CVE-2020-10072 | Medium | 5.9 | 2021-05-25 | Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissi… |
CVE-2020-10069 | Medium | 4.3 | 2021-05-25 | Zephyr Bluetooth unchecked packet data results in denial of service. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Parameters (CWE-233). F… |
CVE-2020-10066 | Low | 2.5 | 2021-05-25 | Incorrect Error Handling in Bluetooth HCI core. Zephyr versions >= v1.14.2, >= v2.2.0 contain NULL Pointer Dereference (CWE-476). For more information, see htt… |
CVE-2020-10065 | Low | 3.8 | 2021-05-25 | Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Length Parameter Inconsistency (CWE-130). For… |