Vulnerabilities in zephyrproject
206 resultsCVE-2026-18415MEDIUMOut-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN framesEPSS 0.1%CVE-2026-79978LOWOut-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read pathEPSS 0.1%CVE-2026-19571MEDIUMRace condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request bufferEPSS 0.1%CVE-2026-17053MEDIUMSMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback stateEPSS 0.1%CVE-2026-87038HIGHTime-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user modeEPSS 0.1%CVE-2026-15890MEDIUMAEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronizationEPSS 0.1%