Vulnerabilidades em zephyrproject
205 resultadosAnálise Vexday
O Zephyr Project apresenta panorama atípico: 40 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, indicando descoberta recente concentrada em um curto período. Nenhuma está sob exploração ativa (KEV) e não há críticas por CVSS, sugerindo severidade moderada; a fraqueza dominante (CWE-416 - use-after-free) aponta para falhas de gerenciamento de memória, típicas em projetos de firmware/RTOS. O risco imediato de exploração é baixo, mas o volume recente exige revisão arquitetural do código.
CVE-2026-75083MEDIUMInteger underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driverEPSS 0.2%CVE-2026-79982HIGHOut-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet sizeEPSS 0.2%CVE-2026-85035HIGHUse-after-free via dynamically allocated message queue retained by the CAN RX filterEPSS 0.2%CVE-2026-13479LOWOut-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handlerEPSS 0.2%CVE-2026-10664MEDIUMOut-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)EPSS 0.2%CVE-2026-10644MEDIUMOut-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte bufferEPSS 0.2%CVE-2026-19577HIGHOut-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer addressEPSS 0.2%CVE-2026-85033MEDIUMBluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peerEPSS 0.2%CVE-2026-16512LOWOut-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet framesEPSS 0.2%CVE-2026-19186HIGHInteger underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and writeEPSS 0.2%CVE-2026-87044MEDIUMMemory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of serviceEPSS 0.2%CVE-2026-85036MEDIUMBluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queueEPSS 0.2%CVE-2026-82388MEDIUMUse of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic hostEPSS 0.2%CVE-2026-81039MEDIUMBluetooth Host connection reservation leak when multiple connectable advertising sets share an identityEPSS 0.2%CVE-2026-78116MEDIUMDouble free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error pathEPSS 0.2%CVE-2026-75085MEDIUMOut-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driverEPSS 0.2%CVE-2026-79977HIGHWireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in ZephyrEPSS 0.2%CVE-2026-18748LOWOut-of-bounds read in Bluetooth Classic A2DP codec information element handlingEPSS 0.2%CVE-2026-10647MEDIUMDeadlock denial of service in USB CDC-NCM device class on TX enqueue failureEPSS 0.2%CVE-2026-19676HIGHPECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user modeEPSS 0.2%