Vulnerabilidades em zephyrproject
206 resultadosAnálise Vexday
O Zephyr Project apresenta panorama atípico: 40 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, indicando descoberta recente concentrada em um curto período. Nenhuma está sob exploração ativa (KEV) e não há críticas por CVSS, sugerindo severidade moderada; a fraqueza dominante (CWE-416 - use-after-free) aponta para falhas de gerenciamento de memória, típicas em projetos de firmware/RTOS. O risco imediato de exploração é baixo, mas o volume recente exige revisão arquitetural do código.
CVE-2026-10647MEDIUMDeadlock denial of service in USB CDC-NCM device class on TX enqueue failureEPSS 0.2%CVE-2026-19676HIGHPECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user modeEPSS 0.2%CVE-2026-82390LOWCross-session AES key confusion in the Espressif ESP32 hardware crypto driverEPSS 0.2%CVE-2026-19940MEDIUMBluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeepingEPSS 0.2%CVE-2026-2411MEDIUMBluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic valuesEPSS 0.2%CVE-2026-87043MEDIUMsys_rand_get() silently returns an unwritten buffer when the entropy device is not readyEPSS 0.2%CVE-2026-19937MEDIUMBluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responsesEPSS 0.2%CVE-2026-85032MEDIUMUse-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progressEPSS 0.2%CVE-2026-19939MEDIUMBluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruptionEPSS 0.2%CVE-2026-19935HIGHUse-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardownEPSS 0.2%CVE-2026-10669HIGHXtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validationEPSS 0.2%CVE-2026-19569HIGHInteger overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heapEPSS 0.2%CVE-2026-19669HIGHUnbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user modeEPSS 0.2%CVE-2026-10643HIGHOut-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)EPSS 0.2%CVE-2026-18417MEDIUMWild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous errorEPSS 0.2%CVE-2026-79980MEDIUMPredictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNSEPSS 0.2%CVE-2026-16511HIGHUnvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memoryEPSS 0.2%CVE-2026-10654LOWRFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth ClassicEPSS 0.2%CVE-2026-8718HIGHOut-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLSEPSS 0.2%CVE-2026-10682MEDIUMOut-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspaceEPSS 0.2%