Zephyrproject - vulnerabilities (CVEs)

322 CVEs in 2 products, 60 in the last 30 days, newest from 2026-10-28.

Products

• Zephyr - 194 CVEs
• Zephyr Project Manager - 0 CVEs

Newest CVEs of Zephyrproject

• CVE-2026-82962 - CVSS 6.5 (medium), 2026-10-28: ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of the packet's first…
• CVE-2026-82961 - CVSS 7.8 (high), 2026-10-28: The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_configure(),…
• CVE-2026-82390 - CVSS 3.7 (low), 2026-10-26: The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX…
• CVE-2026-82389 - CVSS 6.5 (medium), 2026-10-26: In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the…
• CVE-2026-82388 - CVSS 5.3 (medium), 2026-10-26: bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP…
• CVE-2026-19742 - CVSS 3.7 (low), 2026-10-26: The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981…
• CVE-2026-81038 - CVSS 7.1 (high), 2026-10-26: The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send()…
• CVE-2026-81039 - CVSS 4.3 (medium), 2026-10-26: The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it starts, in…
• CVE-2026-79982 - CVSS 8.8 (high), 2026-10-23: The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a…
• CVE-2026-79981 - CVSS 6.5 (medium), 2026-10-23: The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised…
• CVE-2026-79980 - CVSS 5.6 (medium), 2026-10-23: The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a…
• CVE-2026-79979 - CVSS 7.8 (high), 2026-10-23: The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with…
• CVE-2026-79978 - CVSS 3.6 (low), 2026-10-23: The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will…
• CVE-2026-79977 - CVSS 8.2 (high), 2026-10-23: The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(),…
• CVE-2026-19741 - CVSS 7.5 (high), 2026-10-23: Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously…
• CVE-2026-19947 - CVSS 5.3 (medium), 2026-10-21: The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When…
• CVE-2026-79976 - CVSS 7.1 (high), 2026-10-21: The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes…
• CVE-2026-78119 - CVSS 6.3 (medium), 2026-10-21: The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length field…
• CVE-2026-78118 - CVSS 7 (high), 2026-10-21: The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without…
• CVE-2026-78117 - CVSS 4.2 (medium), 2026-10-21: The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable,…
• CVE-2026-18748 - CVSS 3.5 (low), 2026-10-21: The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array.…
• CVE-2026-78116 - CVSS 5.2 (medium), 2026-10-21: The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler()…
• CVE-2026-19676 - CVSS 7.8 (high), 2026-10-21: The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission…
• CVE-2026-77684 - CVSS 5.7 (medium), 2026-10-19: The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release the AT command buffers that are still queued on…
• CVE-2026-19595 - CVSS 6.1 (medium), 2026-10-19: The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len,…
• CVE-2026-76788 - CVSS 8.8 (high), 2026-10-19: The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated…
• CVE-2026-76787 - CVSS 5.9 (medium), 2026-10-19: The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_probe()…
• CVE-2026-75085 - CVSS 4.2 (medium), 2026-10-14: The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length -…
• CVE-2026-75084 - CVSS 6.8 (medium), 2026-10-14: The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in…
• CVE-2026-19673 - CVSS 7.1 (high), 2026-10-14: ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When…