Vulnerabilities in zephyrproject
206 resultsCVE-2026-14986MEDIUMOut-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transactionEPSS 0.3%CVE-2026-13215MEDIUMZephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem imageEPSS 0.3%CVE-2026-14368MEDIUMOff-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parserEPSS 0.3%CVE-2026-10634MEDIUMUse-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callbackEPSS 0.3%CVE-2026-12052MEDIUMOut-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the responseEPSS 0.3%CVE-2026-10773MEDIUMOut-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)EPSS 0.3%CVE-2026-82962MEDIUMOut-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packetEPSS 0.3%CVE-2026-18746MEDIUMNULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhaustedEPSS 0.3%CVE-2026-19741HIGHOpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)EPSS 0.3%CVE-2026-12630MEDIUM6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing modeEPSS 0.3%CVE-2026-16147MEDIUMit82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruptionEPSS 0.3%CVE-2026-13216MEDIUMOut-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability lengthEPSS 0.3%CVE-2026-17054MEDIUMOut-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassemblyEPSS 0.2%CVE-2026-76788HIGHStack out-of-bounds write in the OSDP Control Panel reply parserEPSS 0.2%CVE-2026-15460MEDIUMMissing channel-state validation in Zephyr Bluetooth Classic L2CAP receive pathEPSS 0.2%CVE-2026-19742LOWIPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret keyEPSS 0.2%CVE-2026-16515MEDIUMICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stackEPSS 0.2%CVE-2026-15461MEDIUMType confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS inputEPSS 0.2%CVE-2026-11894MEDIUMDouble-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error pathsEPSS 0.2%CVE-2026-14366MEDIUMSiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pktEPSS 0.2%