ZE
Vendor
zephyrproject
320
CVEs
0
On KEV
63
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-82390 New | ZE zephyr zephyrproject | 3.7 | Oct 26 | Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver |
| CVE-2026-82389 New | ZE zephyr zephyrproject | 6.5 | Oct 26 | Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference |
| CVE-2026-82388 New | ZE zephyr zephyrproject | 5.3 | Oct 26 | Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host |
| CVE-2026-19742 New | ZE zephyr zephyrproject | 3.7 | Oct 26 | IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key |
| CVE-2026-81038 New | ZE zephyr zephyrproject | 7.1 | Oct 26 | Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses |
| CVE-2026-81039 New | ZE zephyr zephyrproject | 4.3 | Oct 26 | Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity |
| CVE-2026-79982 New | ZE zephyr zephyrproject | 8.8 | Oct 23 | Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size |
| CVE-2026-79981 New | ZE zephyr zephyrproject | 6.5 | Oct 23 | DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing |
| CVE-2026-79980 New | ZE zephyr zephyrproject | 5.6 | Oct 23 | Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS |
| CVE-2026-79979 New | ZE zephyr zephyrproject | 7.8 | Oct 23 | Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames |
| CVE-2026-79978 New | ZE zephyr zephyrproject | 3.6 | Oct 23 | Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path |
| CVE-2026-79977 New | ZE zephyr zephyrproject | 8.2 | Oct 23 | WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr |
| CVE-2026-19741 New | ZE zephyr zephyrproject | 7.5 | Oct 23 | OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) |
| CVE-2026-19947 New | ZE zephyr zephyrproject | 5.3 | Oct 21 | Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer |
| CVE-2026-79976 New | ZE zephyr zephyrproject | 7.1 | Oct 21 | NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller |
| CVE-2026-78119 New | ZE zephyr zephyrproject | 6.3 | Oct 21 | Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length |
| CVE-2026-78118 New | ZE zephyr zephyrproject | 7.0 | Oct 21 | Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP |
| CVE-2026-78117 New | ZE zephyr zephyrproject | 4.2 | Oct 21 | Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air |
| CVE-2026-18748 New | ZE zephyr zephyrproject | 3.5 | Oct 21 | Out-of-bounds read in Bluetooth Classic A2DP codec information element handling |
| CVE-2026-78116 New | ZE zephyr zephyrproject | 5.2 | Oct 21 | Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path |
| CVE-2026-19676 New | ZE zephyr zephyrproject | 7.8 | Oct 21 | PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode |
| CVE-2026-77684 | ZE zephyr zephyrproject | 5.7 | Oct 19 | Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service |
| CVE-2026-19595 | ZE zephyr zephyrproject | 6.1 | Oct 19 | Zephyr RTIO syscall verifier validates output parameters for read instead of write access |
| CVE-2026-76788 | ZE zephyr zephyrproject | 8.8 | Oct 19 | Stack out-of-bounds write in the OSDP Control Panel reply parser |
| CVE-2026-76787 | ZE zephyr zephyrproject | 5.9 | Oct 19 | NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum |
| CVE-2026-75085 | ZE zephyr zephyrproject | 4.2 | Oct 14 | Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver |
| CVE-2026-75084 | ZE zephyr zephyrproject | 6.8 | Oct 14 | Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length |
| CVE-2026-19673 | ZE zephyr zephyrproject | 7.1 | Oct 14 | Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header |
| CVE-2026-75083 | ZE zephyr zephyrproject | 5.9 | Oct 14 | Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver |
| CVE-2026-19940 | ZE zephyr zephyrproject | 6.5 | Oct 13 | Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping |
| CVE-2026-19939 | ZE zephyr zephyrproject | 6.3 | Oct 13 | Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption |
| CVE-2026-19938 | ZE zephyr zephyrproject | 5.9 | Oct 12 | Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails |
| CVE-2026-19937 | ZE zephyr zephyrproject | 5.7 | Oct 12 | Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses |
| CVE-2026-19936 | ZE zephyr zephyrproject | 4.8 | Oct 12 | Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference |
| CVE-2026-19740 | ZE zephyr zephyrproject | 6.5 | Oct 11 | Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure |
| CVE-2026-19739 | ZE zephyr zephyrproject | 6.5 | Oct 11 | Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update |
| CVE-2026-19738 | ZE zephyr zephyrproject | 6.5 | Oct 11 | Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures |
| CVE-2026-19935 | ZE zephyr zephyrproject | 7.5 | Oct 11 | Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown |
| CVE-2026-19737 | ZE zephyr zephyrproject | 5.5 | Oct 11 | NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction |
| CVE-2026-18418 | ZE zephyr zephyrproject | 3.4 | Oct 11 | Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name |
| CVE-2026-19736 | ZE zephyr zephyrproject | 7.8 | Oct 11 | Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths |
| CVE-2026-19735 | ZE zephyr zephyrproject | 4.8 | Oct 11 | Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack |
| CVE-2026-19577 | ZE zephyr zephyrproject | 7.1 | Oct 11 | Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address |
| CVE-2026-19576 | ZE zephyr zephyrproject | 6.8 | Oct 11 | Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count |
| CVE-2026-19669 | ZE zephyr zephyrproject | 7.8 | Oct 11 | Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode |
| CVE-2026-19575 | ZE zephyr zephyrproject | 7.8 | Oct 9 | Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code |
| CVE-2026-19569 | ZE zephyr zephyrproject | 8.8 | Oct 9 | Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap |
| CVE-2026-19574 | ZE zephyr zephyrproject | 7.0 | Oct 9 | ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation |
| CVE-2026-19571 | ZE zephyr zephyrproject | 6.7 | Oct 9 | Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer |
| CVE-2026-19570 | ZE zephyr zephyrproject | 8.8 | Oct 9 | Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state |
| CVE-2026-15894 | ZE zephyr zephyrproject | 8.8 | Oct 7 | Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement |
| CVE-2026-19186 | ZE zephyr zephyrproject | 8.1 | Oct 7 | Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write |
| CVE-2026-19185 | ZE zephyr zephyrproject | 7.8 | Oct 5 | Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode |
| CVE-2026-19184 | ZE zephyr zephyrproject | 8.4 | Oct 5 | Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch |
| CVE-2026-17053 | ZE zephyr zephyrproject | 4.4 | Oct 1 | SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state |
| CVE-2026-18747 | ZE zephyr zephyrproject | 6.8 | Sep 28 | Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read |
| CVE-2026-18746 | ZE zephyr zephyrproject | 5.9 | Sep 28 | NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted |
| CVE-2026-18417 | ZE zephyr zephyrproject | 6.5 | Sep 28 | Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error |
| CVE-2026-18416 | ZE zephyr zephyrproject | 5.3 | Sep 28 | Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri) |
| CVE-2026-18415 | ZE zephyr zephyrproject | 7.1 | Sep 28 | Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames |