Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system

Stack buffer overflow in OCPP GetConfiguration key parsing

Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

dns: memory‑safety issue in the DNS name parser

Possible buffer overflow in is_mount_point

Signed to unsigned conversion esp32_ipm_send

can: out of bounds in remove_rx_filter function

Unchecked length coming from user input in settings shell

Possible variant of CVE-2021-3434 in function le_ecred_reconf_req

Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows

Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem

Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer

There is an error in the condition of the last if-statement in the function smp_check_keys

Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr

Buffer overflow in Zephyr USB DFU DNLOAD

DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses

Possible read out of bounds in dns read

Improper Input Frame Validation in ieee802154 Processing

The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution

In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution

An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS

A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0

zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010)

Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem

Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

Out of bounds read in dns_copy_qname

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure…

Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size

Stack out-of-bounds write in the OSDP Control Panel reply parser

Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap

Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields

Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation

Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal

Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly

bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data

net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device

Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c

Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver

Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers

Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host

usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem

In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning

In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning