# cve.now: Zephyrproject-rtos

The newest entries naming Zephyrproject-rtos as an affected vendor (up to 200), of 127 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-13351](https://cve.now/CVE-2026-13351.md): net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets (CVSS 7.5)
- [CVE-2026-5068](https://cve.now/CVE-2026-5068.md): bt: l2cap le coc: remote oob write via seg counter stored in net\_buf user\_data (CVSS 7.6)
- [CVE-2026-5067](https://cve.now/CVE-2026-5067.md): Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key (CVSS 9.8)
- [CVE-2026-5066](https://cve.now/CVE-2026-5066.md): net: sockets: tls: Potential out-of-bounds write/read in socket\_op\_vtable::connect function (CVSS 6.3)
- [CVE-2026-5589](https://cve.now/CVE-2026-5589.md): Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem. (CVSS 6.3)
- [CVE-2026-5071](https://cve.now/CVE-2026-5071.md): can: Local Denial of Service via SocketCAN Send (CVSS 6.1)
- [CVE-2026-5072](https://cve.now/CVE-2026-5072.md): ptp: Potential Denial of Service via PTP Interval Shift (CVSS 6.5)
- [CVE-2026-1681](https://cve.now/CVE-2026-1681.md): net: Stack Overflow with Ping (to own IP Address) via Shell (CVSS 6.1)
- [CVE-2026-1677](https://cve.now/CVE-2026-1677.md): net: TLS 1.2 connections allowed on TLS 1.3 sockets (CVSS 5.3)
- [CVE-2026-5590](https://cve.now/CVE-2026-5590.md): net: ip/tcp: Null pointer dereference can be triggered by a race condition (CVSS 6.4)
- [CVE-2026-1679](https://cve.now/CVE-2026-1679.md): net: eswifi socket send payload length not bounded (CVSS 7.3)
- [CVE-2026-4179](https://cve.now/CVE-2026-4179.md): stm32: usb: Infinite while loop in Interrupt Handler (CVSS 6.1)
- [CVE-2026-0849](https://cve.now/CVE-2026-0849.md): crypto: ATAES132A response length allows stack buffer overflow (CVSS 3.8)
- [CVE-2026-1678](https://cve.now/CVE-2026-1678.md): dns: memory‑safety issue in the DNS name parser (CVSS 9.4)
- [CVE-2025-12899](https://cve.now/CVE-2025-12899.md): net: icmp: Out of bound memory read (CVSS 6.5)
- [CVE-2025-12035](https://cve.now/CVE-2025-12035.md): Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP (CVSS 6.5)
- [CVE-2025-9557](https://cve.now/CVE-2025-9557.md): Bluetooth: Mesh: Out-of-Bound Write in gen\_prov\_cont (CVSS 7.6)
- [CVE-2025-9558](https://cve.now/CVE-2025-9558.md): Bluetooth: Mesh: Out-of-Bound Write in gen\_prov\_start (CVSS 7.6)
- [CVE-2025-9408](https://cve.now/CVE-2025-9408.md): Userspace privilege escalation vulnerability on Cortex M (CVSS 8.2)
- [CVE-2025-12890](https://cve.now/CVE-2025-12890.md): Bluetooth: peripheral: Invalid handling of malformed connection request (CVSS 6.5)
- [CVE-2025-10456](https://cve.now/CVE-2025-10456.md): Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests (CVSS 7.1)
- [CVE-2025-10458](https://cve.now/CVE-2025-10458.md): Bluetooth: le\_conn\_rsp does not sanitize CID, MTU, MPS values (CVSS 7.6)
- [CVE-2025-7403](https://cve.now/CVE-2025-7403.md): Bluetooth: bt\_conn\_tx\_processor unsafe handling (CVSS 7.6)
- [CVE-2025-10457](https://cve.now/CVE-2025-10457.md): Bluetooth: Out-Of-Context le\_conn\_rsp Handling (CVSS 4.3)
- [CVE-2025-2962](https://cve.now/CVE-2025-2962.md): Infinite loop in dns\_copy\_qname (CVSS 8.2)
- [CVE-2025-1675](https://cve.now/CVE-2025-1675.md): Out of bounds read in dns\_copy\_qname (CVSS 8.2)
- [CVE-2025-1674](https://cve.now/CVE-2025-1674.md): Out of bounds read when unpacking DNS answers (CVSS 8.2)
- [CVE-2025-1673](https://cve.now/CVE-2025-1673.md): Out of bounds read when calling crc16\_ansi and strlen in dns\_validate\_msg (CVSS 8.2)
- [CVE-2024-10395](https://cve.now/CVE-2024-10395.md): net: lib: http\_server: Buffer Under-read (CVSS 8.6)
- [CVE-2024-8798](https://cve.now/CVE-2024-8798.md): Bluetooth: classic: avdtp: missing buffer length check (CVSS 7.5)
- [CVE-2024-11263](https://cve.now/CVE-2024-11263.md): arch: riscv: userspace: potential security risk when CONFIG\_RISCV\_GP=y (CVSS 9.4)
- [CVE-2024-6444](https://cve.now/CVE-2024-6444.md): Bluetooth: ots: missing buffer length check (CVSS 6.3)
- [CVE-2024-6443](https://cve.now/CVE-2024-6443.md): zephyr: out-of-bound read in utf8\_trunc (CVSS 6.3)
- [CVE-2024-6442](https://cve.now/CVE-2024-6442.md): Bluetooth: ASCS Unchecked tailroom of the response buffer (CVSS 6.3)
- [CVE-2024-6259](https://cve.now/CVE-2024-6259.md): BT: HCI: adv\_ext\_report Improper discarding in adv\_ext\_report (CVSS 7.6)
- [CVE-2024-6137](https://cve.now/CVE-2024-6137.md): BT: Classic: SDP OOB access in get\_att\_search\_list (CVSS 7.6)
- [CVE-2024-6135](https://cve.now/CVE-2024-6135.md): BT:Classic: Multiple missing buf length checks (CVSS 7.6)
- [CVE-2024-5931](https://cve.now/CVE-2024-5931.md): BT: Unchecked user input in bap\_broadcast\_assistant (CVSS 6.3)
- [CVE-2024-6258](https://cve.now/CVE-2024-6258.md): BT: Missing length checks of net\_buf in rfcomm\_handle\_data (CVSS 6.8)
- [CVE-2024-5754](https://cve.now/CVE-2024-5754.md): BT: Encryption procedure host vulnerability (CVSS 8.2)
- [CVE-2024-4785](https://cve.now/CVE-2024-4785.md): BT: Missing Check in LL\_CONNECTION\_UPDATE\_IND Packet Leads to Division by Zero (CVSS 7.6)
- [CVE-2024-3332](https://cve.now/CVE-2024-3332.md): bt: host/smp: DoS caused by null pointer dereference (CVSS 6.5)
- [CVE-2024-3077](https://cve.now/CVE-2024-3077.md): Bluetooth: integer underflow in gatt\_find\_info\_rsp (CVSS 6.8)
- [CVE-2023-7060](https://cve.now/CVE-2023-7060.md): Missing Security Control in Zephyr OS IP Packet Handling (CVSS 8.6)
- [CVE-2023-6881](https://cve.now/CVE-2023-6881.md): fs: fuse: buffer overflow vulnerability in the Zephyr FS (CVSS 7.3)
- [CVE-2024-1638](https://cve.now/CVE-2024-1638.md): Bluetooth characteristic LESC security requirement not enforced without additional flags (CVSS 8.2)
- [CVE-2023-5779](https://cve.now/CVE-2023-5779.md): can: out of bounds in remove\_rx\_filter function (CVSS 4.4)
- [CVE-2023-6249](https://cve.now/CVE-2023-6249.md): ipm: signed to unsigned conversion problem in esp32\_ipm\_send (CVSS 8.0)
- [CVE-2023-6749](https://cve.now/CVE-2023-6749.md): Unchecked user input length in the Zephyr Settings Shell (CVSS 8.0)
- [CVE-2023-5055](https://cve.now/CVE-2023-5055.md): L2CAP: Possible Stack based buffer overflow in le\_ecred\_reconf\_req() (CVSS 8.3)
- [CVE-2023-4424](https://cve.now/CVE-2023-4424.md): bt: hci: DoS and possible RCE (CVSS 8.3)
- [CVE-2023-5139](https://cve.now/CVE-2023-5139.md): Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driver (CVSS 4.4)
- [CVE-2023-5753](https://cve.now/CVE-2023-5753.md): Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem (CVSS 6.3)
- [CVE-2023-4257](https://cve.now/CVE-2023-4257.md): Unchecked user input length in the Zephyr WiFi shell module (CVSS 7.6)
- [CVE-2023-4263](https://cve.now/CVE-2023-4263.md): Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver (CVSS 7.6)
- [CVE-2023-5563](https://cve.now/CVE-2023-5563.md): The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG\_CAN\_AUTO\_BUS\_OFF\_RECO (CVSS 7.1)
- [CVE-2023-3725](https://cve.now/CVE-2023-3725.md): Potential buffer overflow vulnerability in the Zephyr CANbus subsystem (CVSS 7.6)
- [CVE-2023-5184](https://cve.now/CVE-2023-5184.md): Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver (CVSS 7.0)
- [CVE-2023-4260](https://cve.now/CVE-2023-4260.md): Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem (CVSS 6.3)
- [CVE-2023-4264](https://cve.now/CVE-2023-4264.md): Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem (CVSS 7.1)
- [CVE-2023-4259](https://cve.now/CVE-2023-4259.md): Potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driver (CVSS 7.1)
- [CVE-2023-4258](https://cve.now/CVE-2023-4258.md): bt: mesh: vulnerability in provisioning protocol implementation on provisionee side (CVSS 8.6)
- [CVE-2023-4265](https://cve.now/CVE-2023-4265.md): Buffer overflow in Zephyr USB (CVSS 6.4)
- [CVE-2023-1901](https://cve.now/CVE-2023-1901.md): HCI send\_sync Dangling Semaphore Reference Re-use (CVSS 5.9)
- [CVE-2023-2234](https://cve.now/CVE-2023-2234.md): BT HCI host union variant confusion (CVSS 6.8)
- [CVE-2023-1902](https://cve.now/CVE-2023-1902.md): HCI Connection Creation Dangling State Reference Re-use (CVSS 5.9)
- [CVE-2023-0359](https://cve.now/CVE-2023-0359.md): ipv6: Missing ipv6 nullptr-check in handle\_ra\_input (CVSS 5.9)
- [CVE-2023-0779](https://cve.now/CVE-2023-0779.md): net: shell: Improper input validation (CVSS 6.7)
- [CVE-2021-3329](https://cve.now/CVE-2021-3329.md): DOS: Incorrect handling of the initial HCI ACL\_MTU handshake packet leads to crash of bluetooth host layer (CVSS 9.6)
- [CVE-2023-0397](https://cve.now/CVE-2023-0397.md): DoS: Invalid Initialization in le\_read\_buffer\_size\_complete (CVSS 9.6)
- [CVE-2023-0396](https://cve.now/CVE-2023-0396.md): Buffer Overreads in Bluetooth HCI (CVSS 6.8)
- [CVE-2022-3806](https://cve.now/CVE-2022-3806.md): Bluetooth HCI Error Handling Double Free (CVSS 9.8)
- [CVE-2022-0553](https://cve.now/CVE-2022-0553.md): Possible to retrieve uncrypted firmware image (CVSS 6.5)
- [CVE-2021-3966](https://cve.now/CVE-2021-3966.md): Usb bluetooth device ACL read cb buffer overflow (CVSS 9.6)
- [CVE-2022-2993](https://cve.now/CVE-2022-2993.md): bt: host: Wrong key validation check (CVSS 8.6)
- [CVE-2022-2741](https://cve.now/CVE-2022-2741.md): can: denial-of-service can be triggered by a crafted CAN frame (CVSS 8.2)
- [CVE-2022-1841](https://cve.now/CVE-2022-1841.md): Out-of-bound write in tcp\_flags (CVSS 7.2)
- [CVE-2022-1042](https://cve.now/CVE-2022-1042.md): Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning (CVSS 8.2)
- [CVE-2022-1041](https://cve.now/CVE-2022-1041.md): Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning (CVSS 8.2)
- [CVE-2021-3435](https://cve.now/CVE-2021-3435.md): L2CAP: Information leakage in le\_ecred\_conn\_req() (CVSS 4.0)
- [CVE-2021-3434](https://cve.now/CVE-2021-3434.md): L2CAP: Stack based buffer overflow in le\_ecred\_conn\_req() (CVSS 4.9)
- [CVE-2021-3433](https://cve.now/CVE-2021-3433.md): BT: Invalid channel map in CONNECT\_IND results to Deadlock (CVSS 4.0)
- [CVE-2021-3432](https://cve.now/CVE-2021-3432.md): BT: Invalid interval in CONNECT\_IND leads to Division by Zero (CVSS 4.3)
- [CVE-2021-3431](https://cve.now/CVE-2021-3431.md): BT: Assertion failure on repeated LL\_FEATURE\_REQ (CVSS 4.3)
- [CVE-2021-3430](https://cve.now/CVE-2021-3430.md): BT: Assertion failure on repeated LL\_CONNECTION\_PARAM\_REQ (CVSS 6.5)
- [CVE-2021-3861](https://cve.now/CVE-2021-3861.md): The RNDIS USB device class includes a buffer overflow vulnerability (CVSS 8.2)
- [CVE-2021-3835](https://cve.now/CVE-2021-3835.md): Buffer overflow in usb device class (CVSS 8.2)
- [CVE-2021-3454](https://cve.now/CVE-2021-3454.md): Truncated L2CAP K-frame causes assertion failure (CVSS 4.3)
- [CVE-2021-3455](https://cve.now/CVE-2021-3455.md): Disconnecting L2CAP channel right after invalid ATT request leads freeze (CVSS 4.3)
- [CVE-2021-3330](https://cve.now/CVE-2021-3330.md): RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr (CVSS 7.1)
- [CVE-2021-3323](https://cve.now/CVE-2021-3323.md): Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr (CVSS 8.3)
- [CVE-2021-3322](https://cve.now/CVE-2021-3322.md): Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr (CVSS 6.5)
- [CVE-2021-3321](https://cve.now/CVE-2021-3321.md): Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal (CVSS 7.5)
- [CVE-2021-3625](https://cve.now/CVE-2021-3625.md): Buffer overflow in Zephyr USB DFU DNLOAD (CVSS 9.6)
- [CVE-2021-3581](https://cve.now/CVE-2021-3581.md): Buffer Access with Incorrect Length Value in zephyr (CVSS 7.0)
- [CVE-2021-3510](https://cve.now/CVE-2021-3510.md): Zephyr JSON decoder incorrectly decodes array of array (CVSS 7.5)
- [CVE-2021-3436](https://cve.now/CVE-2021-3436.md): BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known (CVSS 4.3)
- [CVE-2021-3319](https://cve.now/CVE-2021-3319.md): DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses (CVSS 6.5)
- [CVE-2021-3320](https://cve.now/CVE-2021-3320.md): Type Confusion in 802154 ACK Frames Handling (CVSS 5.9)
- [CVE-2020-13603](https://cve.now/CVE-2020-13603.md): Integer Overflow in memory allocating functions (CVSS 6.9)
- [CVE-2020-13602](https://cve.now/CVE-2020-13602.md): Remote Denial of Service in LwM2M do\_write\_op\_tlv (CVSS 4.0)
- [CVE-2020-13601](https://cve.now/CVE-2020-13601.md): Possible read out of bounds in dns read (CVSS 9.0)
- [CVE-2020-13600](https://cve.now/CVE-2020-13600.md): Malformed SPI in response for eswifi can corrupt kernel memory (CVSS 7.0)
- [CVE-2020-13599](https://cve.now/CVE-2020-13599.md): Security problem with settings and littlefs (CVSS 3.3)
- [CVE-2020-13598](https://cve.now/CVE-2020-13598.md): FS: Buffer Overflow when enabling Long File Names in FAT\_FS and calling fs\_stat (CVSS 6.3)
- [CVE-2020-10072](https://cve.now/CVE-2020-10072.md): Improper Handling of Insufficient Permissions or Privileges in zephyr (CVSS 5.9)
- [CVE-2020-10069](https://cve.now/CVE-2020-10069.md): Zephyr Bluetooth unchecked packet data results in denial of service (CVSS 4.3)
- [CVE-2020-10066](https://cve.now/CVE-2020-10066.md): Incorrect Error Handling in Bluetooth HCI core (CVSS 2.5)
- [CVE-2020-10065](https://cve.now/CVE-2020-10065.md): Missing Size Checks in Bluetooth HCI over SPI (CVSS 3.8)
- [CVE-2020-10064](https://cve.now/CVE-2020-10064.md): Improper Input Frame Validation in ieee802154 Processing (CVSS 8.3)
- [CVE-2020-10071](https://cve.now/CVE-2020-10071.md): Insufficient publish message length validation in MQTT (CVSS 9.0)
- [CVE-2020-10070](https://cve.now/CVE-2020-10070.md): MQTT buffer overflow on receive buffer (CVSS 9.0)
- [CVE-2020-10068](https://cve.now/CVE-2020-10068.md): Zephyr Bluetooth DLE duplicate requests vulnerability (CVSS 5.1)
- [CVE-2020-10063](https://cve.now/CVE-2020-10063.md): Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow (CVSS 6.8)
- [CVE-2020-10062](https://cve.now/CVE-2020-10062.md): Packet length decoding error in MQTT (CVSS 9.0)
- [CVE-2020-10061](https://cve.now/CVE-2020-10061.md): Error handling invalid packet sequence (CVSS 8.1)
- [CVE-2020-10067](https://cve.now/CVE-2020-10067.md): Integer Overflow In is\_in\_region Allows User Thread To Access Kernel Memory (CVSS 7.5)
- [CVE-2020-10060](https://cve.now/CVE-2020-10060.md): UpdateHub Might Dereference An Uninitialized Pointer (CVSS 8.0)
- [CVE-2020-10059](https://cve.now/CVE-2020-10059.md): UpdateHub Module Explicitly Disables TLS Verification (CVSS 4.8)
- [CVE-2020-10058](https://cve.now/CVE-2020-10058.md): Multiple Syscalls In kscan Subsystem Performs No Argument Validation (CVSS 7.8)
- [CVE-2020-10028](https://cve.now/CVE-2020-10028.md): Multiple Syscalls In GPIO Subsystem Performs No Argument Validation (CVSS 7.8)
- [CVE-2020-10027](https://cve.now/CVE-2020-10027.md): ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers (CVSS 7.8)
- [CVE-2020-10024](https://cve.now/CVE-2020-10024.md): ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers (CVSS 7.8)
- [CVE-2020-10023](https://cve.now/CVE-2020-10023.md): Shell Subsystem Contains a Buffer Overflow Vulnerability In shell\_spaces\_trim (CVSS 6.9)
- [CVE-2020-10022](https://cve.now/CVE-2020-10022.md): UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array (CVSS 9.0)
- [CVE-2020-10021](https://cve.now/CVE-2020-10021.md): Out-of-bounds write in USB Mass Storage with unaligned sizes (CVSS 8.1)
- [CVE-2020-10019](https://cve.now/CVE-2020-10019.md): Buffer Overflow in USB DFU requested length (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zephyrproject-rtos
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.