Vulnerabilities in zephyrproject
206 resultsCVE-2026-12232MEDIUMOut-of-bounds read via unvalidated stream_id in Intel ALH DAI get_propertiesEPSS 0.1%CVE-2026-81038HIGHBluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responsesEPSS 0.1%CVE-2026-19595MEDIUMZephyr RTIO syscall verifier validates output parameters for read instead of write accessEPSS 0.1%CVE-2026-19936MEDIUMBluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereferenceEPSS 0.1%CVE-2026-78119MEDIUMOut-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet lengthEPSS 0.1%CVE-2026-10677MEDIUMKernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource poolEPSS 0.1%CVE-2026-13478MEDIUMOut-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_countEPSS 0.1%CVE-2026-10674MEDIUMDoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabledEPSS 0.1%CVE-2026-9771HIGHMissing device-pointer validation in flash_copy() syscall allows userspace privilege escalationEPSS 0.1%CVE-2026-12235MEDIUMOut-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)EPSS 0.1%CVE-2026-12634MEDIUMOut-of-bounds stack write in the settings NVS backend from over-reported nvs_read lengthEPSS 0.1%CVE-2026-14367LOWI3C IBI work-node free-list data race between ISR and workqueue threadEPSS 0.1%CVE-2026-10679LOWDivide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)EPSS 0.1%CVE-2026-10684LOWOut-of-bounds read in coredump shell when printing stored-dump target codeEPSS 0.1%CVE-2026-10659MEDIUMNULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resumeEPSS 0.1%CVE-2026-82961HIGHUnvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user modeEPSS 0.1%CVE-2026-12365MEDIUMUse-after-free in Zephyr delayable work-queue cancellation under SMP timing raceEPSS 0.1%CVE-2026-11742LOWUse-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlockEPSS 0.1%CVE-2026-19947MEDIUMMissing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexerEPSS 0.1%CVE-2026-18414HIGHOut-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validationEPSS 0.1%