Zephyrproject vulnerabilities
219 CVEs and advisories name Zephyrproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-13217NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi
- CVE-2026-13216Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length
- CVE-2026-13215Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image
- CVE-2026-13214Stack buffer overflow in OCPP GetConfiguration key parsing
- CVE-2026-13213Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register
- CVE-2026-13212Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id
- CVE-2026-13343Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder
- CVE-2026-9728TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
- CVE-2026-12999Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion
- CVE-2026-12634Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length
- CVE-2026-12522Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields
- CVE-2026-12633Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement
- CVE-2026-12632Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type
- CVE-2026-12631Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel
- CVE-2026-12520Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers
- CVE-2026-12519Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing
- CVE-2026-9771Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation
- CVE-2026-126306LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode
- CVE-2026-12629PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service
- CVE-2026-12366Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal
- CVE-2026-12365Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race
- CVE-2026-12364Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service
- CVE-2026-12363Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0
- CVE-2026-12236Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length
- CVE-2026-12235Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)
- CVE-2026-12234TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write
- CVE-2026-12233Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention
- CVE-2026-12232Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties
- CVE-2026-12052Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response
- CVE-2026-12051NULL pointer dereference in USB DFU device_next download handler (handle_download)