High severity · published May 30, 2023
CVE-2023-0779
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible
7.7
CVSS
0.5%
EPSS
No
On KEV
Description
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
Zephyr · Zephyrproject
through 3.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0779
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0779
Vendor Advisory
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9xj8-6989-r549
More from Zephyr
10.0
CVE-2023-4260
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system
9.8
CVE-2026-13214
Stack buffer overflow in OCPP GetConfiguration key parsing
9.8
CVE-2026-10666
Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`
9.8
CVE-2026-5067
Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
9.8
CVE-2026-1678
dns: memory‑safety issue in the DNS name parser