Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size

Stack out-of-bounds write in the OSDP Control Panel reply parser

Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap

Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields

Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation

Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal

Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly

bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data

net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device

Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c

Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver

Two potential signed to unsigned conversion errors and buffer overflow vulnerabilities at the following locations in the Zephyr IPM drivers

Two potential buffer overflow vulnerabilities at the following locations in the Zephyr eS-WiFi driver source code

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host

usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem

In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning

In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning

Buffer overflow in usb device class

RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr

Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal

Buffer Access with Incorrect Length Value in zephyr

Missing Size Checks in Bluetooth HCI over SPI

Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption

Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch

Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service

Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the…

WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

Out of bounds read when unpacking DNS answers

Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg

Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement

NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller

Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref

Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets

Bluetooth: Out-Of-Context le_conn_rsp Handling

The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a…

The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of…

Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode

Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames

PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths

Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode

Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code

Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode