Vulnerabilidades em zephyrproject
206 resultadosAnálise Vexday
O Zephyr Project apresenta panorama atípico: 40 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, indicando descoberta recente concentrada em um curto período. Nenhuma está sob exploração ativa (KEV) e não há críticas por CVSS, sugerindo severidade moderada; a fraqueza dominante (CWE-416 - use-after-free) aponta para falhas de gerenciamento de memória, típicas em projetos de firmware/RTOS. O risco imediato de exploração é baixo, mas o volume recente exige revisão arquitetural do código.
CVE-2026-15894HIGHBluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisementEPSS 0.3%CVE-2026-10685HIGHUse-after-free of GATT subscribe params in Bluetooth host CCC-write response handlerEPSS 0.3%CVE-2026-11368HIGHUse-after-free in Bluetooth host ATT TX completion on disconnect mid-transferEPSS 0.3%CVE-2026-10637MEDIUMUse-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD QueryEPSS 0.3%CVE-2026-10651HIGHOut-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)EPSS 0.3%CVE-2026-77684MEDIUMBluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of serviceEPSS 0.3%CVE-2026-19570HIGHOut-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive stateEPSS 0.3%CVE-2026-10774LOWPSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoSEPSS 0.3%CVE-2026-12520MEDIUMStack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlersEPSS 0.3%CVE-2026-79976HIGHNULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controllerEPSS 0.3%CVE-2026-16514MEDIUMOut-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemovedEPSS 0.3%CVE-2026-87040HIGHBluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and writeEPSS 0.3%CVE-2026-75084MEDIUMOut-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet lengthEPSS 0.3%CVE-2026-14697MEDIUMIPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of serviceEPSS 0.3%CVE-2026-12632MEDIUMOut-of-bounds read in Zephyr PTP message parsing from unvalidated message typeEPSS 0.3%CVE-2026-10641HIGHOut-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)EPSS 0.3%CVE-2026-10658HIGHOut-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validationEPSS 0.3%CVE-2026-10642MEDIUMUnbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow controlEPSS 0.3%CVE-2026-10656MEDIUMNULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlersEPSS 0.3%CVE-2026-13215MEDIUMZephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem imageEPSS 0.3%