What’s Vulnerable › Products
zephyrproject zephyr vulnerabilities
314 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 216 published in the last 12 months.
Check whether your zephyrproject zephyr version is affected
Latest zephyrproject zephyr vulnerabilities
- CVE-2026-82962 — Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet (CVSS 6.5)
- CVE-2026-82961 — Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode (CVSS 7.8)
- CVE-2026-82390 — Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver (CVSS 3.7)
- CVE-2026-82389 — Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference (CVSS 6.5)
- CVE-2026-82388 — Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host (CVSS 5.3)
- CVE-2026-19742 — IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key (CVSS 3.7)
- CVE-2026-81038 — Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses (CVSS 7.1)
- CVE-2026-81039 — Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity (CVSS 4.3)
- CVE-2026-79982 — Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size (CVSS 8.8)
- CVE-2026-79981 — DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing (CVSS 6.5)
- CVE-2026-79980 — Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS (CVSS 5.6)
- CVE-2026-79979 — Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames (CVSS 7.8)
- CVE-2026-79978 — Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path (CVSS 3.6)
- CVE-2026-79977 — WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr (CVSS 8.2)
- CVE-2026-19741 — OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) (CVSS 7.5)
- CVE-2026-79976 — NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller (CVSS 7.1)
- CVE-2026-78119 — Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length (CVSS 6.3)
- CVE-2026-78118 — Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP (CVSS 7.0)
- CVE-2026-78117 — Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air (CVSS 4.2)
- CVE-2026-78116 — Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path (CVSS 5.2)
- CVE-2026-19947 — Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer (CVSS 5.3)
- CVE-2026-19676 — PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode (CVSS 7.8)
- CVE-2026-18748 — Out-of-bounds read in Bluetooth Classic A2DP codec information element handling (CVSS 3.5)
- CVE-2026-77684 — Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service (CVSS 5.7)
- CVE-2026-19595 — Zephyr RTIO syscall verifier validates output parameters for read instead of write access (CVSS 6.1)