# cve.now: Zephyrproject

The newest entries naming Zephyrproject as an affected vendor (up to 200), of 219 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-90834](https://cve.now/CVE-2026-90834.md): UART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel… (CVSS 5.5)
- [CVE-2026-90833](https://cve.now/CVE-2026-90833.md): Signed offset bypasses bounds check in simulated EEPROM driver, allowing out-of-bounds kernel memory read and write from user mode (CVSS 7.8)
- [CVE-2026-77685](https://cve.now/CVE-2026-77685.md): Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and… (CVSS 8.3)
- [CVE-2026-87042](https://cve.now/CVE-2026-87042.md): Zephyr PTP: unvalidated Delay\_Resp message interval lets an on-link peer wedge the PTP thread and flood the network (CVSS 6.5)
- [CVE-2026-82391](https://cve.now/CVE-2026-82391.md): Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length (CVSS 9.1)
- [CVE-2026-90832](https://cve.now/CVE-2026-90832.md): Out-of-bounds read in Bluetooth Host periodic advertising report reassembly due to unvalidated report length (CVSS 4.3)
- [CVE-2026-90591](https://cve.now/CVE-2026-90591.md): NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop (CVSS 7.5)
- [CVE-2026-90590](https://cve.now/CVE-2026-90590.md): Permanent loss of transmit capability in the NXP ENET QoS Ethernet driver after an Ethernet link drop (CVSS 6.5)
- [CVE-2026-90589](https://cve.now/CVE-2026-90589.md): Memory-mapped thread stack is never unmapped when a thread is aborted by another thread, exhausting kernel virtual address space (CVSS 5.5)
- [CVE-2026-90588](https://cve.now/CVE-2026-90588.md): Out-of-bounds read in Zephyr HTTP client debug logging of response header fields (CVSS 3.7)
- [CVE-2026-90587](https://cve.now/CVE-2026-90587.md): NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations (CVSS 4.6)
- [CVE-2026-90586](https://cve.now/CVE-2026-90586.md): Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes (CVSS 7.8)
- [CVE-2026-90585](https://cve.now/CVE-2026-90585.md): Renesas RA SCI UART driver: unacknowledged receive-error interrupt causes a permanent interrupt storm and CPU lockup (CVSS 4.6)
- [CVE-2026-87045](https://cve.now/CVE-2026-87045.md): NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame (CVSS 7.5)
- [CVE-2026-87044](https://cve.now/CVE-2026-87044.md): Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service (CVSS 6.5)
- [CVE-2026-87043](https://cve.now/CVE-2026-87043.md): sys\_rand\_get() silently returns an unwritten buffer when the entropy device is not ready (CVSS 4.8)
- [CVE-2026-87041](https://cve.now/CVE-2026-87041.md): Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory (CVSS 7.8)
- [CVE-2026-87040](https://cve.now/CVE-2026-87040.md): Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read… (CVSS 8.3)
- [CVE-2026-87039](https://cve.now/CVE-2026-87039.md): I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers (CVSS 7.8)
- [CVE-2026-87038](https://cve.now/CVE-2026-87038.md): Time-of-check/time-of-use double fetch in the Zephyr i3c\_transfer() syscall handler allows kernel-mode control-flow hijack from user mode (CVSS 7.0)
- [CVE-2026-16511](https://cve.now/CVE-2026-16511.md): Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory (CVSS 8.8)
- [CVE-2026-85036](https://cve.now/CVE-2026-85036.md): Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue (CVSS 5.7)
- [CVE-2026-85035](https://cve.now/CVE-2026-85035.md): Use-after-free via dynamically allocated message queue retained by the CAN RX filter (CVSS 8.8)
- [CVE-2026-85034](https://cve.now/CVE-2026-85034.md): Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers (CVSS 6.7)
- [CVE-2026-85033](https://cve.now/CVE-2026-85033.md): Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next… (CVSS 4.6)
- [CVE-2026-85032](https://cve.now/CVE-2026-85032.md): Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress (CVSS 4.8)
- [CVE-2026-82962](https://cve.now/CVE-2026-82962.md): Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet (CVSS 6.5)
- [CVE-2026-82961](https://cve.now/CVE-2026-82961.md): Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode (CVSS 7.8)
- [CVE-2026-82390](https://cve.now/CVE-2026-82390.md): Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver (CVSS 3.7)
- [CVE-2026-82389](https://cve.now/CVE-2026-82389.md): Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference (CVSS 6.5)
- [CVE-2026-82388](https://cve.now/CVE-2026-82388.md): Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host (CVSS 5.3)
- [CVE-2026-19742](https://cve.now/CVE-2026-19742.md): IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key (CVSS 3.7)
- [CVE-2026-81038](https://cve.now/CVE-2026-81038.md): Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses (CVSS 7.1)
- [CVE-2026-81039](https://cve.now/CVE-2026-81039.md): Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity (CVSS 4.3)
- [CVE-2026-79982](https://cve.now/CVE-2026-79982.md): Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet… (CVSS 8.8)
- [CVE-2026-79981](https://cve.now/CVE-2026-79981.md): DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing (CVSS 6.5)
- [CVE-2026-79980](https://cve.now/CVE-2026-79980.md): Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS (CVSS 5.6)
- [CVE-2026-79979](https://cve.now/CVE-2026-79979.md): Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames (CVSS 7.8)
- [CVE-2026-79978](https://cve.now/CVE-2026-79978.md): Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path (CVSS 3.6)
- [CVE-2026-79977](https://cve.now/CVE-2026-79977.md): WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr (CVSS 8.2)
- [CVE-2026-19741](https://cve.now/CVE-2026-19741.md): OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) (CVSS 7.5)
- [CVE-2026-19947](https://cve.now/CVE-2026-19947.md): Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer (CVSS 5.3)
- [CVE-2026-79976](https://cve.now/CVE-2026-79976.md): NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller (CVSS 7.1)
- [CVE-2026-78119](https://cve.now/CVE-2026-78119.md): Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length (CVSS 6.3)
- [CVE-2026-78118](https://cve.now/CVE-2026-78118.md): Race condition on kernel wait queues: unlocked z\_waitq\_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP (CVSS 7.0)
- [CVE-2026-78117](https://cve.now/CVE-2026-78117.md): Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air (CVSS 4.2)
- [CVE-2026-18748](https://cve.now/CVE-2026-18748.md): Out-of-bounds read in Bluetooth Classic A2DP codec information element handling (CVSS 3.5)
- [CVE-2026-78116](https://cve.now/CVE-2026-78116.md): Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path (CVSS 5.2)
- [CVE-2026-19676](https://cve.now/CVE-2026-19676.md): PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode (CVSS 7.8)
- [CVE-2026-77684](https://cve.now/CVE-2026-77684.md): Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service (CVSS 5.7)
- [CVE-2026-19595](https://cve.now/CVE-2026-19595.md): Zephyr RTIO syscall verifier validates output parameters for read instead of write access (CVSS 6.1)
- [CVE-2026-76788](https://cve.now/CVE-2026-76788.md): Stack out-of-bounds write in the OSDP Control Panel reply parser (CVSS 8.8)
- [CVE-2026-76787](https://cve.now/CVE-2026-76787.md): NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum (CVSS 5.9)
- [CVE-2026-75085](https://cve.now/CVE-2026-75085.md): Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver (CVSS 4.2)
- [CVE-2026-75084](https://cve.now/CVE-2026-75084.md): Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length (CVSS 6.8)
- [CVE-2026-19673](https://cve.now/CVE-2026-19673.md): Out-of-bounds read and net\_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header (CVSS 7.1)
- [CVE-2026-75083](https://cve.now/CVE-2026-75083.md): Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver (CVSS 5.9)
- [CVE-2026-19940](https://cve.now/CVE-2026-19940.md): Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping (CVSS 6.5)
- [CVE-2026-19939](https://cve.now/CVE-2026-19939.md): Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption (CVSS 6.3)
- [CVE-2026-19938](https://cve.now/CVE-2026-19938.md): Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails (CVSS 5.9)
- [CVE-2026-19937](https://cve.now/CVE-2026-19937.md): Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses (CVSS 5.7)
- [CVE-2026-19936](https://cve.now/CVE-2026-19936.md): Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference (CVSS 4.8)
- [CVE-2026-19740](https://cve.now/CVE-2026-19740.md): Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure (CVSS 6.5)
- [CVE-2026-19739](https://cve.now/CVE-2026-19739.md): Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update (CVSS 6.5)
- [CVE-2026-19738](https://cve.now/CVE-2026-19738.md): Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures (CVSS 6.5)
- [CVE-2026-19935](https://cve.now/CVE-2026-19935.md): Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown (CVSS 7.5)
- [CVE-2026-19737](https://cve.now/CVE-2026-19737.md): NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction (CVSS 5.5)
- [CVE-2026-18418](https://cve.now/CVE-2026-18418.md): Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name (CVSS 3.4)
- [CVE-2026-19736](https://cve.now/CVE-2026-19736.md): Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths (CVSS 7.8)
- [CVE-2026-19735](https://cve.now/CVE-2026-19735.md): Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack (CVSS 4.8)
- [CVE-2026-19577](https://cve.now/CVE-2026-19577.md): Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address (CVSS 7.1)
- [CVE-2026-19576](https://cve.now/CVE-2026-19576.md): Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count (CVSS 6.8)
- [CVE-2026-19669](https://cve.now/CVE-2026-19669.md): Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode (CVSS 7.8)
- [CVE-2026-19575](https://cve.now/CVE-2026-19575.md): Type confusion in the device\_deinit system call allows user-mode threads to execute arbitrary kernel code (CVSS 7.8)
- [CVE-2026-19569](https://cve.now/CVE-2026-19569.md): Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap (CVSS 8.8)
- [CVE-2026-19574](https://cve.now/CVE-2026-19574.md): ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation (CVSS 7.0)
- [CVE-2026-19571](https://cve.now/CVE-2026-19571.md): Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request… (CVSS 6.7)
- [CVE-2026-19570](https://cve.now/CVE-2026-19570.md): Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state (CVSS 8.8)
- [CVE-2026-15894](https://cve.now/CVE-2026-15894.md): Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement (CVSS 8.8)
- [CVE-2026-19186](https://cve.now/CVE-2026-19186.md): Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write (CVSS 8.1)
- [CVE-2026-19185](https://cve.now/CVE-2026-19185.md): Unvalidated user-supplied buffer pointers in the I3C do\_ccc system call handler allow kernel memory read/write from user mode (CVSS 7.8)
- [CVE-2026-19184](https://cve.now/CVE-2026-19184.md): Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch (CVSS 8.4)
- [CVE-2026-17053](https://cve.now/CVE-2026-17053.md): SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state (CVSS 4.4)
- [CVE-2026-18747](https://cve.now/CVE-2026-18747.md): Integer underflow of net\_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read (CVSS 6.8)
- [CVE-2026-18746](https://cve.now/CVE-2026-18746.md): NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted (CVSS 5.9)
- [CVE-2026-18417](https://cve.now/CVE-2026-18417.md): Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error (CVSS 6.5)
- [CVE-2026-18416](https://cve.now/CVE-2026-18416.md): Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match\_path\_uri) (CVSS 3.7)
- [CVE-2026-18415](https://cve.now/CVE-2026-18415.md): Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames (CVSS 6.3)
- [CVE-2026-18414](https://cve.now/CVE-2026-18414.md): Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc\_sequence buffer size validation (CVSS 7.8)
- [CVE-2026-18413](https://cve.now/CVE-2026-18413.md): Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc\_sequence buffer size validation (CVSS 7.8)
- [CVE-2026-16513](https://cve.now/CVE-2026-16513.md): Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write (CVSS 7.8)
- [CVE-2026-17054](https://cve.now/CVE-2026-17054.md): Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly (CVSS 5.3)
- [CVE-2026-15890](https://cve.now/CVE-2026-15890.md): AEAD nonce reuse in Zephyr secure\_storage ITS default nonce provider due to missing thread synchronization (CVSS 5.3)
- [CVE-2026-17052](https://cve.now/CVE-2026-17052.md): Missing user-pointer validation in tgpio\_pin\_read\_ts\_ec syscall handler allows arbitrary supervisor-memory write from userspace (CVSS 7.8)
- [CVE-2026-17051](https://cve.now/CVE-2026-17051.md): Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length (CVSS 6.0)
- [CVE-2026-17050](https://cve.now/CVE-2026-17050.md): Double free of the USB host configuration descriptor when device enumeration fails (CVSS 5.7)
- [CVE-2026-16515](https://cve.now/CVE-2026-16515.md): ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6… (CVSS 4.7)
- [CVE-2026-16514](https://cve.now/CVE-2026-16514.md): Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved (CVSS 4.3)
- [CVE-2026-16512](https://cve.now/CVE-2026-16512.md): Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames (CVSS 3.1)
- [CVE-2026-14986](https://cve.now/CVE-2026-14986.md): Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction (CVSS 6.8)
- [CVE-2026-16148](https://cve.now/CVE-2026-16148.md): Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item (CVSS 4.6)
- [CVE-2026-16147](https://cve.now/CVE-2026-16147.md): it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption (CVSS 6.8)
- [CVE-2026-15924](https://cve.now/CVE-2026-15924.md): Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets (CVSS 5.9)
- [CVE-2026-15893](https://cve.now/CVE-2026-15893.md): Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS (CVSS 6.5)
- [CVE-2026-15923](https://cve.now/CVE-2026-15923.md): Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max\_blk\_size (CVSS 4.6)
- [CVE-2026-15892](https://cve.now/CVE-2026-15892.md): Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service (CVSS 5.3)
- [CVE-2026-15891](https://cve.now/CVE-2026-15891.md): NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway (CVSS 7.5)
- [CVE-2026-15461](https://cve.now/CVE-2026-15461.md): Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input (CVSS 5.3)
- [CVE-2026-15460](https://cve.now/CVE-2026-15460.md): Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path (CVSS 5.4)
- [CVE-2026-14697](https://cve.now/CVE-2026-14697.md): IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service (CVSS 6.5)
- [CVE-2026-14696](https://cve.now/CVE-2026-14696.md): Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion (CVSS 6.5)
- [CVE-2026-14368](https://cve.now/CVE-2026-14368.md): Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser (CVSS 5.4)
- [CVE-2026-14367](https://cve.now/CVE-2026-14367.md): I3C IBI work-node free-list data race between ISR and workqueue thread (CVSS 3.1)
- [CVE-2026-14366](https://cve.now/CVE-2026-14366.md): SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net\_pkt (CVSS 6.4)
- [CVE-2026-13735](https://cve.now/CVE-2026-13735.md): WireGuard keepalive transport-data messages accepted without Poly1305 authentication (CVSS 3.7)
- [CVE-2026-13734](https://cve.now/CVE-2026-13734.md): Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack (CVSS 6.5)
- [CVE-2026-13481](https://cve.now/CVE-2026-13481.md): Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP (CVSS 5.4)
- [CVE-2026-13480](https://cve.now/CVE-2026-13480.md): Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler (CVSS 3.1)
- [CVE-2026-13479](https://cve.now/CVE-2026-13479.md): Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler (CVSS 3.1)
- [CVE-2026-13478](https://cve.now/CVE-2026-13478.md): Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s\_blocks\_count (CVSS 5.5)
- [CVE-2026-13217](https://cve.now/CVE-2026-13217.md): NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok\_r/atoi (CVSS 5.9)
- [CVE-2026-13216](https://cve.now/CVE-2026-13216.md): Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length (CVSS 6.1)
- [CVE-2026-13215](https://cve.now/CVE-2026-13215.md): Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image (CVSS 6.8)
- [CVE-2026-13214](https://cve.now/CVE-2026-13214.md): Stack buffer overflow in OCPP GetConfiguration key parsing (CVSS 9.8)
- [CVE-2026-13213](https://cve.now/CVE-2026-13213.md): Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt\_has\_register (CVSS 5.3)
- [CVE-2026-13212](https://cve.now/CVE-2026-13212.md): Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id (CVSS 8.8)
- [CVE-2026-13343](https://cve.now/CVE-2026-13343.md): Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder (CVSS 5.3)
- [CVE-2026-9728](https://cve.now/CVE-2026-9728.md): TOCTOU race in mbox\_send syscall verifier allows userspace to leak kernel memory (CVSS 6.4)
- [CVE-2026-12999](https://cve.now/CVE-2026-12999.md): Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion (CVSS 5.3)
- [CVE-2026-12634](https://cve.now/CVE-2026-12634.md): Out-of-bounds stack write in the settings NVS backend from over-reported nvs\_read length (CVSS 5.3)
- [CVE-2026-12522](https://cve.now/CVE-2026-12522.md): Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields (CVSS 8.8)
- [CVE-2026-12633](https://cve.now/CVE-2026-12633.md): Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement (CVSS 8.1)
- [CVE-2026-12632](https://cve.now/CVE-2026-12632.md): Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type (CVSS 6.5)
- [CVE-2026-12631](https://cve.now/CVE-2026-12631.md): Broken access-control denial in k\_thread\_join/k\_thread\_abort syscall validation in Zephyr kernel (CVSS 6.5)
- [CVE-2026-12520](https://cve.now/CVE-2026-12520.md): Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers (CVSS 6.4)
- [CVE-2026-12519](https://cve.now/CVE-2026-12519.md): Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing (CVSS 5.0)
- [CVE-2026-9771](https://cve.now/CVE-2026-9771.md): Missing device-pointer validation in flash\_copy() syscall allows userspace privilege escalation (CVSS 8.8)
- [CVE-2026-12630](https://cve.now/CVE-2026-12630.md): 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode (CVSS 4.3)
- [CVE-2026-12629](https://cve.now/CVE-2026-12629.md): PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service (CVSS 4.6)
- [CVE-2026-12366](https://cve.now/CVE-2026-12366.md): Use-after-free freeing an armed dynamically-allocated k\_timer in Zephyr userspace object disposal (CVSS 8.8)
- [CVE-2026-12365](https://cve.now/CVE-2026-12365.md): Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race (CVSS 5.8)
- [CVE-2026-12364](https://cve.now/CVE-2026-12364.md): Missing user-space pointer validation in logging syscall z\_log\_msg\_static\_create allows kernel memory disclosure and denial of service (CVSS 8.4)
- [CVE-2026-12363](https://cve.now/CVE-2026-12363.md): Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0 (CVSS 4.2)
- [CVE-2026-12236](https://cve.now/CVE-2026-12236.md): Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length (CVSS 6.5)
- [CVE-2026-12235](https://cve.now/CVE-2026-12235.md): Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787) (CVSS 6.3)
- [CVE-2026-12234](https://cve.now/CVE-2026-12234.md): TOCTOU double-fetch in \`zsock\_sendmsg\`/\`recvmsg\` userspace verifiers allows kernel-heap out-of-bounds write (CVSS 7.8)
- [CVE-2026-12233](https://cve.now/CVE-2026-12233.md): Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention (CVSS 5.9)
- [CVE-2026-12232](https://cve.now/CVE-2026-12232.md): Out-of-bounds read via unvalidated stream\_id in Intel ALH DAI get\_properties (CVSS 6.1)
- [CVE-2026-12052](https://cve.now/CVE-2026-12052.md): Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response (CVSS 5.2)
- [CVE-2026-12051](https://cve.now/CVE-2026-12051.md): NULL pointer dereference in USB DFU device\_next download handler (handle\_download) (CVSS 4.6)
- [CVE-2026-11894](https://cve.now/CVE-2026-11894.md): Double-free / use-after-free in Realtek BEE Bluetooth HCI driver \`send()\` error paths (CVSS 5.9)
- [CVE-2026-11985](https://cve.now/CVE-2026-11985.md): Cross-thread FPU register leak on ARM when FPU enabled without register sharing (CVSS 3.6)
- [CVE-2026-11893](https://cve.now/CVE-2026-11893.md): Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci\_bflb) (CVSS 5.9)
- [CVE-2026-11812](https://cve.now/CVE-2026-11812.md): UpdateHub: race condition on shared context causes out-of-bounds write and DoS (CVSS 2.5)
- [CVE-2026-11811](https://cve.now/CVE-2026-11811.md): Socket file-descriptor leak in UpdateHub OTA client start\_coap\_client() leading to resource-exhaustion DoS (CVSS 3.7)
- [CVE-2026-8718](https://cve.now/CVE-2026-8718.md): Out-of-bounds write in DTLS peer Connection ID getsockopt (\`TLS\_DTLS\_PEER\_CID\_VALUE\`) in Zephyr net sockets/TLS (CVSS 8.4)
- [CVE-2026-11809](https://cve.now/CVE-2026-11809.md): UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata (CVSS 3.7)
- [CVE-2026-11810](https://cve.now/CVE-2026-11810.md): NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS) (CVSS 7.5)
- [CVE-2026-11743](https://cve.now/CVE-2026-11743.md): Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write (CVSS 6.6)
- [CVE-2026-11742](https://cve.now/CVE-2026-11742.md): Use-after-free race in kernel \`k\_queue\_peek\_head/tail\` due to missing spinlock (CVSS 3.6)
- [CVE-2026-11368](https://cve.now/CVE-2026-11368.md): Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer (CVSS 7.1)
- [CVE-2026-10849](https://cve.now/CVE-2026-10849.md): Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body (CVSS 8.2)
- [CVE-2026-10848](https://cve.now/CVE-2026-10848.md): Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse\_rpc\_msg) (CVSS 7.0)
- [CVE-2026-10774](https://cve.now/CVE-2026-10774.md): PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS (CVSS 2.4)
- [CVE-2026-10773](https://cve.now/CVE-2026-10773.md): Out-of-bounds read in DHCPv4 client message-type name lookup (net\_dhcpv4\_msg\_type\_name) (CVSS 5.4)
- [CVE-2026-2411](https://cve.now/CVE-2026-2411.md): Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values (CVSS 6.5)
- [CVE-2026-10686](https://cve.now/CVE-2026-10686.md): Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers (CVSS 5.8)
- [CVE-2026-10685](https://cve.now/CVE-2026-10685.md): Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler (CVSS 7.6)
- [CVE-2026-10684](https://cve.now/CVE-2026-10684.md): Out-of-bounds read in coredump shell when printing stored-dump target code (CVSS 3.0)
- [CVE-2026-10683](https://cve.now/CVE-2026-10683.md): DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS) (CVSS 2.4)
- [CVE-2026-10682](https://cve.now/CVE-2026-10682.md): Out-of-bounds write in Zephyr \`log\_filter\_set\` syscall verifier reachable from userspace (CVSS 6.6)
- [CVE-2026-10681](https://cve.now/CVE-2026-10681.md): SMP race in \`thread\_idx\_alloc()\` lets concurrent \`k\_object\_alloc(K\_OBJ\_THREAD)\` callers share a kernel-object permission slot (CVSS 6.5)
- [CVE-2026-7007](https://cve.now/CVE-2026-7007.md): Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image (CVSS 4.6)
- [CVE-2026-10680](https://cve.now/CVE-2026-10680.md): Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via \`uint16\_t\` length underflow (CVSS 7.6)
- [CVE-2026-10679](https://cve.now/CVE-2026-10679.md): Divide-by-zero in DesignWare SPI driver reachable from spi\_transceive syscall (local DoS) (CVSS 3.3)
- [CVE-2026-10678](https://cve.now/CVE-2026-10678.md): NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller (CVSS 8.1)
- [CVE-2026-10677](https://cve.now/CVE-2026-10677.md): Kernel heap memory leak in \`z\_vrfy\_k\_poll()\` lets an unprivileged user thread exhaust the kernel resource pool (CVSS 6.5)
- [CVE-2026-10675](https://cve.now/CVE-2026-10675.md): Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS) (CVSS 4.3)
- [CVE-2026-10674](https://cve.now/CVE-2026-10674.md): DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled (CVSS 5.5)
- [CVE-2026-10673](https://cve.now/CVE-2026-10673.md): Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly (CVSS 8.3)
- [CVE-2026-10672](https://cve.now/CVE-2026-10672.md): Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) (CVSS 8.2)
- [CVE-2026-10671](https://cve.now/CVE-2026-10671.md): User thread can re-initialize an in-use \`k\_pipe\`, corrupting kernel wait queues (\`CONFIG\_USERSPACE\`) (CVSS 7.1)
- [CVE-2026-10670](https://cve.now/CVE-2026-10670.md): User-triggerable kernel NULL-pointer dereference (DoS) in \`k\_thread\_name\_copy()\` syscall verifier (CVSS 5.5)
- [CVE-2026-10669](https://cve.now/CVE-2026-10669.md): Xtensa MPU \`arch\_buffer\_validate()\` integer-overflow lets a user thread bypass syscall pointer validation (CVSS 7.8)
- [CVE-2026-10668](https://cve.now/CVE-2026-10668.md): Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver (CVSS 2.4)
- [CVE-2026-10667](https://cve.now/CVE-2026-10667.md): SMP use-after-free in Zephyr \`CONFIG\_USERSPACE\` dynamic kernel-object tracking, reachable from unprivileged user threads (CVSS 7.8)
- [CVE-2026-10666](https://cve.now/CVE-2026-10666.md): Stack buffer overflow in \`net\_ipaddr\_parse()\` IPv4 address-with-port parsing in \`subsys/net/ip/utils.c\` (CVSS 8.1)
- [CVE-2026-10665](https://cve.now/CVE-2026-10665.md): Heap buffer overflow on WireGuard receive path via unbounded incoming packet length (CVSS 7.4)
- [CVE-2026-10664](https://cve.now/CVE-2026-10664.md): Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count) (CVSS 5.0)
- [CVE-2026-10663](https://cve.now/CVE-2026-10663.md): Use-after-free / double-free of the root USB device in the experimental USB host stack (CVSS 6.1)
- [CVE-2026-10660](https://cve.now/CVE-2026-10660.md): Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption (CVSS 6.4)
- [CVE-2026-10659](https://cve.now/CVE-2026-10659.md): NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume (CVSS 4.7)
- [CVE-2026-10657](https://cve.now/CVE-2026-10657.md): Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL) (CVSS 3.7)
- [CVE-2026-10656](https://cve.now/CVE-2026-10656.md): NULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlers (CVSS 4.6)
- [CVE-2026-10655](https://cve.now/CVE-2026-10655.md): Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it (CVSS 6.5)
- [CVE-2026-10654](https://cve.now/CVE-2026-10654.md): RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic (CVSS 3.1)
- [CVE-2026-10653](https://cve.now/CVE-2026-10653.md): Non-atomic \`net\_buf\` reference counts cause double-free / free-list corruption under concurrent unref (CVSS 6.4)
- [CVE-2026-9263](https://cve.now/CVE-2026-9263.md): Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets (CVSS 6.5)
- [CVE-2026-10652](https://cve.now/CVE-2026-10652.md): Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated \`rdlength\`) (CVSS 4.8)
- [CVE-2026-10648](https://cve.now/CVE-2026-10648.md): NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion (CVSS 6.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zephyrproject
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.