Zzephyrproject

Products

Exploited and recent CVEs

• CVE-2026-87044 Medium 6.5 Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service 0.2%
• CVE-2026-87043 Medium 4.8 sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready 0.2%
• CVE-2026-87041 High 7.8 Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory 0.1%
• CVE-2026-87040 High 8.3 Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write 0.3%
• CVE-2026-87039 High 7.8 I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers 0.1%
• CVE-2026-87038 High 7.0 Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode <0.1%
• CVE-2026-16511 High 8.8 Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory 0.2%
• CVE-2026-85036 Medium 5.7 Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue 0.2%
• CVE-2026-85035 High 8.8 Use-after-free via dynamically allocated message queue retained by the CAN RX filter 0.2%
• CVE-2026-85034 Medium 6.7 Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers 0.2%
• CVE-2026-85033 Medium 4.6 Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer 0.2%
• CVE-2026-85032 Medium 4.8 Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress 0.2%
• CVE-2026-82962 Medium 6.5 Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet 0.3%
• CVE-2026-82961 High 7.8 Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode 0.1%
• CVE-2026-82390 Low 3.7 Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver 0.2%
• CVE-2026-82389 Medium 6.5 Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference 0.2%
• CVE-2026-82388 Medium 5.3 Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host 0.2%
• CVE-2026-19742 Low 3.7 IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key 0.2%
• CVE-2026-81038 High 7.1 Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses 0.1%
• CVE-2026-81039 Medium 4.3 Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity 0.2%
• CVE-2026-79982 High 8.8 Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size 0.2%
• CVE-2026-79981 Medium 6.5 DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing 0.1%
• CVE-2026-79980 Medium 5.6 Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS 0.2%
• CVE-2026-79979 High 7.8 Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames 0.1%
• CVE-2026-79978 Low 3.6 Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path <0.1%
• CVE-2026-79977 High 8.2 WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr 0.2%
• CVE-2026-19741 High 7.5 OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) 0.3%
• CVE-2026-19947 Medium 5.3 Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer 0.1%
• CVE-2026-79976 High 7.1 NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller 0.3%
• CVE-2026-78119 Medium 6.3 Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length 0.1%