USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash,…

Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution

At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible

Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values

Malformed SPI in response for eswifi can corrupt kernel memory

OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)

Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway

NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error

Infinite loop in dns_copy_qname

net: lib: http_server: Buffer Under-read

Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address

The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y

A missing nullptr-check in handle_ra_input can cause a nullptr-deref

can: denial-of-service can be triggered by a crafted CAN frame

Invalid interval in CONNECT_IND leads to Division by Zero

Assertion reachable with repeated LL_FEATURE_REQ

Assertion reachable with repeated LL_CONNECTION_PARAM_REQ

Disconnecting L2CAP channel right after invalid ATT request leads freeze

Truncated L2CAP K-frame causes assertion failure

Zephyr JSON decoder incorrectly decodes array of array

Type Confusion in 802154 ACK Frames Handling

A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service

Heap buffer overflow on WireGuard receive path via unbounded incoming packet length

Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)

Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation

Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses

NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header

Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address

Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames

User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)

Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation

Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)

Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)

Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query

Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation

SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length

Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count

Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read