Zephyrproject vulnerabilities
219 CVEs and advisories name Zephyrproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-16513Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write
- CVE-2026-17054Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly
- CVE-2026-15890AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization
- CVE-2026-17052Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace
- CVE-2026-17051Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length
- CVE-2026-17050Double free of the USB host configuration descriptor when device enumeration fails
- CVE-2026-16515ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6…
- CVE-2026-16514Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved
- CVE-2026-16512Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames
- CVE-2026-14986Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction
- CVE-2026-16148Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item
- CVE-2026-16147it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption
- CVE-2026-15924Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets
- CVE-2026-15893Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS
- CVE-2026-15923Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size
- CVE-2026-15892Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service
- CVE-2026-15891NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway
- CVE-2026-15461Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input
- CVE-2026-15460Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path
- CVE-2026-14697IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service
- CVE-2026-14696Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion
- CVE-2026-14368Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
- CVE-2026-14367I3C IBI work-node free-list data race between ISR and workqueue thread
- CVE-2026-14366SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt
- CVE-2026-13735WireGuard keepalive transport-data messages accepted without Poly1305 authentication
- CVE-2026-13734Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack
- CVE-2026-13481Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP
- CVE-2026-13480Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
- CVE-2026-13479Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
- CVE-2026-13478Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count