Zephyrproject vulnerabilities
219 CVEs and advisories name Zephyrproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-90834UART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel…
- CVE-2026-90833Signed offset bypasses bounds check in simulated EEPROM driver, allowing out-of-bounds kernel memory read and write from user mode
- CVE-2026-77685Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and…
- CVE-2026-87042Zephyr PTP: unvalidated Delay_Resp message interval lets an on-link peer wedge the PTP thread and flood the network
- CVE-2026-82391Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length
- CVE-2026-90832Out-of-bounds read in Bluetooth Host periodic advertising report reassembly due to unvalidated report length
- CVE-2026-90591NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop
- CVE-2026-90590Permanent loss of transmit capability in the NXP ENET QoS Ethernet driver after an Ethernet link drop
- CVE-2026-90589Memory-mapped thread stack is never unmapped when a thread is aborted by another thread, exhausting kernel virtual address space
- CVE-2026-90588Out-of-bounds read in Zephyr HTTP client debug logging of response header fields
- CVE-2026-90587NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations
- CVE-2026-90586Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes
- CVE-2026-90585Renesas RA SCI UART driver: unacknowledged receive-error interrupt causes a permanent interrupt storm and CPU lockup
- CVE-2026-87045NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame
- CVE-2026-87044Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service
- CVE-2026-87043sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready
- CVE-2026-87041Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory
- CVE-2026-87040Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read…
- CVE-2026-87039I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers
- CVE-2026-87038Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode
- CVE-2026-16511Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
- CVE-2026-85036Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue
- CVE-2026-85035Use-after-free via dynamically allocated message queue retained by the CAN RX filter
- CVE-2026-85034Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers
- CVE-2026-85033Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next…
- CVE-2026-85032Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress
- CVE-2026-82962Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet
- CVE-2026-82961Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode
- CVE-2026-82390Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver
- CVE-2026-82389Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference