Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation

Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation

Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write

Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace

TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace

Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validation

SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads

Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)

can: Local Denial of Service via SocketCAN Send

net: eswifi socket send payload length not bounded

Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver

Stack based buffer overflow in le_ecred_conn_req()

Integer Overflow in memory allocating functions

FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat

A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers

Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace to potentially gain elevated privileges

Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions

An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel

The arm platform-specific code uses a signed integer comparison when validating system call numbers

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-ZEP-026 This issue affects: zephyrproject-rtos zephyr…

USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash,…

Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution

At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible

Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values

Malformed SPI in response for eswifi can corrupt kernel memory

OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)

Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway

NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error

Infinite loop in dns_copy_qname

No proper validation of the length of user input in http_server_get_content_type_from_extension

Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address

The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y

A missing nullptr-check in handle_ra_input can cause a nullptr-deref

can: denial-of-service can be triggered by a crafted CAN frame

Invalid interval in CONNECT_IND leads to Division by Zero

Assertion reachable with repeated LL_FEATURE_REQ

Assertion reachable with repeated LL_CONNECTION_PARAM_REQ

Disconnecting L2CAP channel right after invalid ATT request leads freeze

Truncated L2CAP K-frame causes assertion failure

Zephyr JSON decoder incorrectly decodes array of array