Vulnerabilities in zephyrproject
206 resultsCVE-2026-12629MEDIUMPL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of serviceEPSS 0.2%CVE-2026-12051MEDIUMNULL pointer dereference in USB DFU device_next download handler (handle_download)EPSS 0.2%CVE-2026-75083MEDIUMInteger underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driverEPSS 0.2%CVE-2026-79982HIGHOut-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet sizeEPSS 0.2%CVE-2026-85035HIGHUse-after-free via dynamically allocated message queue retained by the CAN RX filterEPSS 0.2%CVE-2026-13479LOWOut-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handlerEPSS 0.2%CVE-2026-10664MEDIUMOut-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)EPSS 0.2%CVE-2026-10644MEDIUMOut-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte bufferEPSS 0.2%CVE-2026-19577HIGHOut-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer addressEPSS 0.2%CVE-2026-85033MEDIUMBluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peerEPSS 0.2%CVE-2026-16512LOWOut-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet framesEPSS 0.2%CVE-2026-19186HIGHInteger underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and writeEPSS 0.2%CVE-2026-85036MEDIUMBluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queueEPSS 0.2%CVE-2026-87044MEDIUMMemory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of serviceEPSS 0.2%CVE-2026-82388MEDIUMUse of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic hostEPSS 0.2%CVE-2026-81039MEDIUMBluetooth Host connection reservation leak when multiple connectable advertising sets share an identityEPSS 0.2%CVE-2026-78116MEDIUMDouble free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error pathEPSS 0.2%CVE-2026-75085MEDIUMOut-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driverEPSS 0.2%CVE-2026-79977HIGHWireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in ZephyrEPSS 0.2%CVE-2026-18748LOWOut-of-bounds read in Bluetooth Classic A2DP codec information element handlingEPSS 0.2%