Zephyrproject vulnerabilities
219 CVEs and advisories name Zephyrproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-10645Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image
- CVE-2026-10641Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)
- CVE-2026-10640Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)
- CVE-2026-10639Use-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`
- CVE-2026-10638Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error
- CVE-2026-10637Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query
- CVE-2026-10636Use-after-free in Zephyr IPv4 IGMP send path (`igmp_send`)
- CVE-2026-10635Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init
- CVE-2026-10634Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callback