zephyrproject-rtos Zephyr

• CVE-2026-13351 High 7.5 net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets 0.5%
• CVE-2026-5068 High 7.6 bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data 0.5%
• CVE-2026-5067 Critical 9.8 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key 0.6%
• CVE-2026-5066 Medium 6.3 net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function 0.3%
• CVE-2026-5589 Medium 6.3 Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem. 0.3%
• CVE-2026-5071 Medium 6.1 can: Local Denial of Service via SocketCAN Send 0.2%
• CVE-2026-5072 Medium 6.5 ptp: Potential Denial of Service via PTP Interval Shift 0.3%
• CVE-2026-1681 Medium 6.1 net: Stack Overflow with Ping (to own IP Address) via Shell 0.1%
• CVE-2026-1677 Medium 5.3 net: TLS 1.2 connections allowed on TLS 1.3 sockets 0.2%
• CVE-2026-5590 Medium 6.4 net: ip/tcp: Null pointer dereference can be triggered by a race condition 0.2%
• CVE-2026-1679 High 7.3 net: eswifi socket send payload length not bounded 0.2%
• CVE-2026-4179 Medium 6.1 stm32: usb: Infinite while loop in Interrupt Handler 0.2%
• CVE-2026-0849 Low 3.8 crypto: ATAES132A response length allows stack buffer overflow 0.2%
• CVE-2026-1678 Critical 9.4 dns: memory‑safety issue in the DNS name parser 0.4%
• CVE-2025-12899 Medium 6.5 net: icmp: Out of bound memory read 0.3%
• CVE-2025-12035 Medium 6.5 Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP 0.2%
• CVE-2025-9557 High 7.6 Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont 0.2%
• CVE-2025-9558 High 7.6 Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start 0.2%
• CVE-2025-9408 High 8.2 Userspace privilege escalation vulnerability on Cortex M 0.1%
• CVE-2025-12890 Medium 6.5 Bluetooth: peripheral: Invalid handling of malformed connection request 0.2%
• CVE-2025-10456 High 7.1 Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests 0.2%
• CVE-2025-10458 High 7.6 Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values 0.2%
• CVE-2025-7403 High 7.6 Bluetooth: bt_conn_tx_processor unsafe handling 0.2%
• CVE-2025-10457 Medium 4.3 Bluetooth: Out-Of-Context le_conn_rsp Handling 0.4%
• CVE-2025-2962 High 8.2 Infinite loop in dns_copy_qname 0.6%
• CVE-2025-1675 High 8.2 Out of bounds read in dns_copy_qname 0.4%
• CVE-2025-1674 High 8.2 Out of bounds read when unpacking DNS answers 0.4%
• CVE-2025-1673 High 8.2 Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg 0.4%
• CVE-2024-10395 High 8.6 net: lib: http_server: Buffer Under-read 0.3%
• CVE-2024-8798 High 7.5 Bluetooth: classic: avdtp: missing buffer length check 0.4%
• CVE-2024-11263 Critical 9.4 arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y 0.2%
• CVE-2024-6444 Medium 6.3 Bluetooth: ots: missing buffer length check 0.3%
• CVE-2024-6443 Medium 6.3 zephyr: out-of-bound read in utf8_trunc 0.6%
• CVE-2024-6442 Medium 6.3 Bluetooth: ASCS Unchecked tailroom of the response buffer 0.3%
• CVE-2024-6259 High 7.6 BT: HCI: adv_ext_report Improper discarding in adv_ext_report 0.6%
• CVE-2024-6137 High 7.6 BT: Classic: SDP OOB access in get_att_search_list 0.5%
• CVE-2024-6135 High 7.6 BT:Classic: Multiple missing buf length checks 0.4%
• CVE-2024-5931 Medium 6.3 BT: Unchecked user input in bap_broadcast_assistant 0.4%
• CVE-2024-6258 Medium 6.8 BT: Missing length checks of net_buf in rfcomm_handle_data 0.4%
• CVE-2024-5754 High 8.2 BT: Encryption procedure host vulnerability 0.3%
• CVE-2024-4785 High 7.6 BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero 0.5%
• CVE-2024-3332 Medium 6.5 bt: host/smp: DoS caused by null pointer dereference 0.4%
• CVE-2024-3077 Medium 6.8 Bluetooth: integer underflow in gatt_find_info_rsp 0.5%
• CVE-2023-7060 High 8.6 Missing Security Control in Zephyr OS IP Packet Handling 0.5%
• CVE-2023-6881 High 7.3 fs: fuse: buffer overflow vulnerability in the Zephyr FS 0.4%
• CVE-2024-1638 High 8.2 Bluetooth characteristic LESC security requirement not enforced without additional flags 0.4%
• CVE-2023-5779 Medium 4.4 can: out of bounds in remove_rx_filter function 0.4%
• CVE-2023-6249 High 8.0 ipm: signed to unsigned conversion problem in esp32_ipm_send 0.4%
• CVE-2023-6749 High 8.0 Unchecked user input length in the Zephyr Settings Shell 0.4%
• CVE-2023-5055 High 8.3 L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req() 0.8%