Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction

it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image

Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack

crypto: ATAES132A response length allows stack buffer overflow

In DA, there is a possible out of bounds write due to a missing bounds check

Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359…

A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses

The RNDIS USB device class includes a buffer overflow vulnerability

The shell subsystem contains a buffer overflow, whereby an adversary with physical access to the device is able to cause a memory corruption, resulting in denial of service or…

Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer

In gnss service, there is a possible out of bounds write due to an incorrect bounds check

In gnss service, there is a possible out of bounds write due to an incorrect bounds check

Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write

Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet

Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference

DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping

Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure

Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update

Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures

Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error

Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS

IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service

Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion

Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack

Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type

Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel

Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length

Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer

PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS

Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values

Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool

Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling

Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)

ptp: Potential Denial of Service via PTP Interval Shift

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

Bluetooth: bt_conn_tx_processor unsafe handling

No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c

No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c

In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty

In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow

BT: HCI: adv_ext_report Improper discarding in adv_ext_report

BT: Classic: SDP OOB access in get_att_search_list

BT:Classic: Multiple missing buf length checks

BT: Unchecked user input in bap_broadcast_assistant

BT: Missing length checks of net_buf in rfcomm_handle_data

BT: Encryption procedure host vulnerability

BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero