Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system

Stack buffer overflow in OCPP GetConfiguration key parsing

Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

dns: memory‑safety issue in the DNS name parser

Possible buffer overflow in is_mount_point

Signed to unsigned conversion esp32_ipm_send

can: out of bounds in remove_rx_filter function

Unchecked length coming from user input in settings shell

Possible variant of CVE-2021-3434 in function le_ecred_reconf_req

Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows

Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem

Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer

There is an error in the condition of the last if-statement in the function smp_check_keys

Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr

Buffer overflow in Zephyr USB DFU DNLOAD

DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses

Possible read out of bounds in dns read

Improper Input Frame Validation in ieee802154 Processing

The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution

In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution

An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS

A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0

zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010)

Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem

Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

Out of bounds read in dns_copy_qname

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure…