Vulnerabilidades en zephyrproject
206 resultadosCVE-2026-10678HIGHNULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controllerEPSS 0.4%CVE-2026-10675MEDIUMBluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)EPSS 0.4%CVE-2026-87045HIGHNULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frameEPSS 0.4%CVE-2026-10655MEDIUMUse-after-free race in SNTP async client when closing the socket while the socket service is still polling itEPSS 0.4%CVE-2026-10848HIGHOut-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)EPSS 0.4%CVE-2026-10640MEDIUMUse-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)EPSS 0.4%CVE-2026-13212HIGHZephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor idEPSS 0.4%CVE-2026-76787MEDIUMNULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sumEPSS 0.4%CVE-2026-10593MEDIUMRemotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handlingEPSS 0.4%CVE-2026-11809LOWUpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadataEPSS 0.4%CVE-2026-10638MEDIUMUse-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or errorEPSS 0.4%CVE-2026-12522HIGHStack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fieldsEPSS 0.3%CVE-2026-19673HIGHOut-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN headerEPSS 0.3%CVE-2026-13734MEDIUMZephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijackEPSS 0.3%CVE-2026-14696MEDIUMEthernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustionEPSS 0.3%CVE-2026-7656HIGHBroken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stackEPSS 0.3%CVE-2026-9263MEDIUMOut-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packetsEPSS 0.3%CVE-2026-15893MEDIUMZephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoSEPSS 0.3%CVE-2026-13735LOWWireGuard keepalive transport-data messages accepted without Poly1305 authenticationEPSS 0.3%CVE-2026-12633HIGHOut-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router AdvertisementEPSS 0.3%