Vulnerabilidades em zephyrproject
205 resultadosAnálise Vexday
O Zephyr Project apresenta panorama atípico: 40 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, indicando descoberta recente concentrada em um curto período. Nenhuma está sob exploração ativa (KEV) e não há críticas por CVSS, sugerindo severidade moderada; a fraqueza dominante (CWE-416 - use-after-free) aponta para falhas de gerenciamento de memória, típicas em projetos de firmware/RTOS. O risco imediato de exploração é baixo, mas o volume recente exige revisão arquitetural do código.
CVE-2026-14367LOWI3C IBI work-node free-list data race between ISR and workqueue threadEPSS 0.1%CVE-2026-10679LOWDivide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)EPSS 0.1%CVE-2026-10684LOWOut-of-bounds read in coredump shell when printing stored-dump target codeEPSS 0.1%CVE-2026-10659MEDIUMNULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resumeEPSS 0.1%CVE-2026-82961HIGHUnvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user modeEPSS 0.1%CVE-2026-11742LOWUse-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlockEPSS 0.1%CVE-2026-12365MEDIUMUse-after-free in Zephyr delayable work-queue cancellation under SMP timing raceEPSS 0.1%CVE-2026-19947MEDIUMMissing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexerEPSS 0.1%CVE-2026-11985LOWCross-thread FPU register leak on ARM when FPU enabled without register sharingEPSS 0.1%CVE-2026-18414HIGHOut-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validationEPSS 0.1%CVE-2026-18413HIGHOut-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validationEPSS 0.1%CVE-2026-79981MEDIUMDNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofingEPSS 0.1%CVE-2026-19575HIGHType confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel codeEPSS 0.1%CVE-2026-18747MEDIUMInteger underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds readEPSS 0.1%CVE-2026-10681MEDIUMSMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slotEPSS 0.1%CVE-2026-19736HIGHOut-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengthsEPSS 0.1%CVE-2026-9728MEDIUMTOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memoryEPSS 0.1%CVE-2026-12234HIGHTOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds writeEPSS 0.1%CVE-2026-18418LOWOut-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel nameEPSS 0.1%CVE-2026-19740MEDIUMBluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedureEPSS 0.1%