zephyrproject zephyr

• CVE-2026-13735 Low 3.7 WireGuard keepalive transport-data messages accepted without Poly1305 authentication 0.3%
• CVE-2026-13734 Medium 6.5 Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack 0.3%
• CVE-2026-13481 Medium 5.4 Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP 0.2%
• CVE-2026-13480 Low 3.1 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler 0.2%
• CVE-2026-13479 Low 3.1 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler 0.2%
• CVE-2026-13478 Medium 5.5 Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count 0.1%
• CVE-2026-13217 Medium 5.9 NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi 0.7%
• CVE-2026-13216 Medium 6.1 Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length 0.3%
• CVE-2026-13215 Medium 6.8 Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image 0.3%
• CVE-2026-13214 Critical 9.8 Stack buffer overflow in OCPP GetConfiguration key parsing 0.9%
• CVE-2026-13213 Medium 5.3 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register 0.2%
• CVE-2026-13212 High 8.8 Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id 0.4%
• CVE-2026-13343 Medium 5.3 Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder 0.4%
• CVE-2026-9728 Medium 6.4 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory 0.1%
• CVE-2026-12999 Medium 5.3 Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion 0.2%
• CVE-2026-12634 Medium 5.3 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length 0.1%
• CVE-2026-12522 High 8.8 Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields 0.3%
• CVE-2026-12633 High 8.1 Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement 0.3%
• CVE-2026-12632 Medium 6.5 Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type 0.3%
• CVE-2026-12631 Medium 6.5 Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel 0.2%
• CVE-2026-12520 Medium 6.4 Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers 0.3%
• CVE-2026-12519 Medium 5.0 Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing 0.2%
• CVE-2026-9771 High 8.8 Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation 0.1%
• CVE-2026-12630 Medium 4.3 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode 0.3%
• CVE-2026-12629 Medium 4.6 PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service 0.2%
• CVE-2026-12366 High 8.8 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal 0.2%
• CVE-2026-12365 Medium 5.8 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race 0.1%
• CVE-2026-12364 High 8.4 Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service 0.2%
• CVE-2026-12363 Medium 4.2 Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0 0.2%
• CVE-2026-12236 Medium 6.5 Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length 0.2%
• CVE-2026-12235 Medium 6.3 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787) 0.1%
• CVE-2026-12234 High 7.8 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write 0.1%
• CVE-2026-12233 Medium 5.9 Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention 0.5%
• CVE-2026-12232 Medium 6.1 Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties 0.1%
• CVE-2026-12052 Medium 5.2 Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response 0.3%
• CVE-2026-12051 Medium 4.6 NULL pointer dereference in USB DFU device_next download handler (handle_download) 0.2%
• CVE-2026-11894 Medium 5.9 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths 0.2%
• CVE-2026-11985 Low 3.6 Cross-thread FPU register leak on ARM when FPU enabled without register sharing 0.1%
• CVE-2026-11893 Medium 5.9 Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb) 0.2%
• CVE-2026-11812 Low 2.5 UpdateHub: race condition on shared context causes out-of-bounds write and DoS 0.1%
• CVE-2026-11811 Low 3.7 Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS 0.4%
• CVE-2026-8718 High 8.4 Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS 0.2%
• CVE-2026-11809 Low 3.7 UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata 0.4%
• CVE-2026-11810 High 7.5 NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS) 0.5%
• CVE-2026-11743 Medium 6.6 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write 0.1%
• CVE-2026-11742 Low 3.6 Use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock 0.1%
• CVE-2026-11368 High 7.1 Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer 0.3%
• CVE-2026-10849 High 8.2 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body 0.5%
• CVE-2026-10848 High 7.0 Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg) 0.4%
• CVE-2026-10774 Low 2.4 PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS 0.3%