Vulnerabilidades en zephyrproject
206 resultadosCVE-2026-19576MEDIUMStack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point countEPSS 0.2%CVE-2026-19185HIGHUnvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user modeEPSS 0.2%CVE-2026-16513HIGHMissing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel writeEPSS 0.2%CVE-2026-12366HIGHUse-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposalEPSS 0.2%CVE-2026-17052HIGHMissing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspaceEPSS 0.2%CVE-2026-10635MEDIUMDangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-initEPSS 0.2%CVE-2026-19938MEDIUMUse-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command failsEPSS 0.2%CVE-2026-10680HIGHOut-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflowEPSS 0.2%CVE-2026-19735MEDIUMPredictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stackEPSS 0.2%CVE-2026-78117MEDIUMRace condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the airEPSS 0.2%CVE-2026-12236MEDIUMInfinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data lengthEPSS 0.2%CVE-2026-12364HIGHMissing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of serviceEPSS 0.2%CVE-2026-10671HIGHUser thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)EPSS 0.2%CVE-2026-17051MEDIUMOut-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell lengthEPSS 0.2%CVE-2026-10645MEDIUMOut-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem imageEPSS 0.2%CVE-2026-12631MEDIUMBroken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernelEPSS 0.2%CVE-2026-10648MEDIUMNULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustionEPSS 0.2%CVE-2026-10670MEDIUMUser-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifierEPSS 0.2%CVE-2026-11743MEDIUMMissing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and writeEPSS 0.1%CVE-2026-10667HIGHSMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threadsEPSS 0.1%