Buffer overflow in usb device class

RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr

Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal

Buffer Access with Incorrect Length Value in zephyr

Missing Size Checks in Bluetooth HCI over SPI

Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption

Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch

Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service

Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the…

WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

Out of bounds read when unpacking DNS answers

Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg

Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement

NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller

Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref

Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets

Bluetooth: Out-Of-Context le_conn_rsp Handling

The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a…

The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of…

Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode

Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames

PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths

Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode

Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code

Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode

Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation

Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation

Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write

Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace

TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace

Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validation

SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads

Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)

can: Local Denial of Service via SocketCAN Send

net: eswifi socket send payload length not bounded

Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver

Stack based buffer overflow in le_ecred_conn_req()

Integer Overflow in memory allocating functions

FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat

A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers

Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges

Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions

An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel

The arm platform-specific code uses a signed integer comparison when validating system call numbers

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr…