[ Vendor · 50 CVEs ]
zephyrproject
CVEs affecting zephyrproject published in the last 30 days, plus any zephyrproject CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-79976 | 21 Oct 2026 | CVSS 7.1 | zephyrproject zephyrThe MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller… | |
| CVE-2026-78116 | 21 Oct 2026 | CVSS 5.2 | zephyrproject zephyrThe Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In… | |
| CVE-2026-78117 | 21 Oct 2026 | CVSS 4.2 | zephyrproject zephyrThe Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope… | |
| CVE-2026-78118 | 21 Oct 2026 | CVSS 7.0 | zephyrproject zephyrThe kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several… | |
| CVE-2026-78119 | 21 Oct 2026 | CVSS 6.3 | zephyrproject zephyrThe Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length… | |
| CVE-2026-18748 | 21 Oct 2026 | CVSS 3.5 | zephyrproject zephyrThe Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte… | |
| CVE-2026-19676 | 21 Oct 2026 | CVSS 7.8 | zephyrproject zephyrThe user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object… | |
| CVE-2026-19947 | 21 Oct 2026 | CVSS 5.3 | zephyrproject zephyrThe device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When… | |
| CVE-2026-77684 | 19 Oct 2026 | CVSS 5.7 | zephyrproject zephyrThe Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still… | |
| CVE-2026-19595 | 19 Oct 2026 | CVSS 6.1 | zephyrproject zephyrThe user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and… | |
| CVE-2026-76787 | 19 Oct 2026 | CVSS 5.9 | zephyrproject zephyrThe UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe()… | |
| CVE-2026-76788 | 19 Oct 2026 | CVSS 8.8 | zephyrproject zephyrThe OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a… | |
| CVE-2026-75083 | 14 Oct 2026 | CVSS 5.9 | zephyrproject zephyrThe receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len =… | |
| CVE-2026-75084 | 14 Oct 2026 | CVSS 6.8 | zephyrproject zephyrThe CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates… | |
| CVE-2026-75085 | 14 Oct 2026 | CVSS 4.2 | zephyrproject zephyrThe STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len =… | |
| CVE-2026-19673 | 14 Oct 2026 | CVSS 7.1 | zephyrproject zephyrethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct… | |
| CVE-2026-19940 | 13 Oct 2026 | CVSS 6.5 | zephyrproject zephyrThe Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in… | |
| CVE-2026-19939 | 13 Oct 2026 | CVSS 6.3 | zephyrproject zephyrThe AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request… | |
| CVE-2026-19936 | 13 Oct 2026 | CVSS 4.8 | zephyrproject zephyrThe Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx… | |
| CVE-2026-19937 | 13 Oct 2026 | CVSS 5.7 | zephyrproject zephyrThe Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of… | |
| CVE-2026-19938 | 13 Oct 2026 | CVSS 5.9 | zephyrproject zephyrThe Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents… | |
| CVE-2026-19738 | 11 Oct 2026 | CVSS 6.5 | zephyrproject zephyrThe Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node… | |
| CVE-2026-19739 | 11 Oct 2026 | CVSS 6.5 | zephyrproject zephyrThe Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a… | |
| CVE-2026-19740 | 11 Oct 2026 | CVSS 6.5 | zephyrproject zephyrThe Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an… | |
| CVE-2026-19935 | 11 Oct 2026 | CVSS 7.5 | zephyrproject zephyrThe Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the… | |
| CVE-2026-18418 | 11 Oct 2026 | CVSS 3.4 | zephyrproject zephyrThe zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a… | |
| CVE-2026-19576 | 11 Oct 2026 | CVSS 6.8 | zephyrproject zephyrThe Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with… | |
| CVE-2026-19577 | 11 Oct 2026 | CVSS 7.1 | zephyrproject zephyrnet_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first… | |
| CVE-2026-19669 | 11 Oct 2026 | CVSS 7.8 | zephyrproject zephyrThe user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c… | |
| CVE-2026-19735 | 11 Oct 2026 | CVSS 4.8 | zephyrproject zephyrThe RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a… | |
| CVE-2026-19736 | 11 Oct 2026 | CVSS 7.8 | zephyrproject zephyrThe NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine… | |
| CVE-2026-19737 | 11 Oct 2026 | CVSS 5.5 | zephyrproject zephyri2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches… | |
| CVE-2026-19575 | 9 Oct 2026 | CVSS 7.8 | zephyrproject zephyrThe user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with… | |
| CVE-2026-19569 | 9 Oct 2026 | CVSS 8.8 | zephyrproject zephyrdynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as… | |
| CVE-2026-19570 | 9 Oct 2026 | CVSS 8.8 | zephyrproject zephyrThe LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE)… | |
| CVE-2026-19571 | 9 Oct 2026 | CVSS 6.7 | zephyrproject zephyrThe ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request… | |
| CVE-2026-19574 | 9 Oct 2026 | CVSS 7.0 | zephyrproject zephyrThe ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init()… | |
| CVE-2026-15894 | 7 Oct 2026 | CVSS 8.8 | zephyrproject zephyrThe Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a… | |
| CVE-2026-19186 | 7 Oct 2026 | CVSS 8.1 | zephyrproject zephyrieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len -… | |
| CVE-2026-19185 | 5 Oct 2026 | CVSS 7.8 | zephyrproject zephyrThe system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and… | |
| CVE-2026-19184 | 5 Oct 2026 | CVSS 8.4 | zephyrproject zephyrThe NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the… | |
| CVE-2026-17053 | 1 Oct 2026 | CVSS 4.4 | zephyrproject zephyrThe SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in… | |
| CVE-2026-18417 | 29 Sep 2026 | CVSS 6.5 | zephyrproject zephyrThe native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field… | |
| CVE-2026-18746 | 29 Sep 2026 | CVSS 5.9 | zephyrproject zephyrparse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the… | |
| CVE-2026-18747 | 29 Sep 2026 | CVSS 6.8 | zephyrproject zephyrThe MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips… | |
| CVE-2026-18413 | 28 Sep 2026 | CVSS 7.8 | zephyrproject zephyrThe ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in… | |
| CVE-2026-18414 | 28 Sep 2026 | CVSS 7.8 | zephyrproject zephyrThe ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in… | |
| CVE-2026-18415 | 28 Sep 2026 | CVSS 6.3 | zephyrproject zephyrieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer… | |
| CVE-2026-18416 | 28 Sep 2026 | CVSS 3.7 | zephyrproject zephyrThe CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in… | |
| CVE-2026-16513 | 28 Sep 2026 | CVSS 7.8 | zephyrproject zephyrThe userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the… |