Zephyrproject vulnerabilities
219 CVEs and advisories name Zephyrproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-10672Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)
- CVE-2026-10671User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)
- CVE-2026-10670User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier
- CVE-2026-10669Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validation
- CVE-2026-10668Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver
- CVE-2026-10667SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads
- CVE-2026-10666Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`
- CVE-2026-10665Heap buffer overflow on WireGuard receive path via unbounded incoming packet length
- CVE-2026-10664Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)
- CVE-2026-10663Use-after-free / double-free of the root USB device in the experimental USB host stack
- CVE-2026-10660Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption
- CVE-2026-10659NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume
- CVE-2026-10657Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)
- CVE-2026-10656NULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlers
- CVE-2026-10655Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it
- CVE-2026-10654RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic
- CVE-2026-10653Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref
- CVE-2026-9263Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets
- CVE-2026-10652Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)
- CVE-2026-10648NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion
- CVE-2026-8023Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read
- CVE-2026-7656Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack
- CVE-2026-10647Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure
- CVE-2026-10593Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling
- CVE-2026-10646Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation
- CVE-2026-10644Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer
- CVE-2026-10643Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)
- CVE-2026-10642Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control
- CVE-2026-10658Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation
- CVE-2026-10651Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)