zephyrproject zephyr

• CVE-2026-10773 Medium 5.4 Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name) 0.3%
• CVE-2026-2411 Medium 6.5 Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values 0.2%
• CVE-2026-10686 Medium 5.8 Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers 0.6%
• CVE-2026-10685 High 7.6 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler 0.3%
• CVE-2026-10684 Low 3.0 Out-of-bounds read in coredump shell when printing stored-dump target code 0.1%
• CVE-2026-10683 Low 2.4 DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS) 0.2%
• CVE-2026-10682 Medium 6.6 Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace 0.2%
• CVE-2026-10681 Medium 6.5 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot 0.1%
• CVE-2026-7007 Medium 4.6 Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image 0.2%
• CVE-2026-10680 High 7.6 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow 0.2%
• CVE-2026-10679 Low 3.3 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS) 0.1%
• CVE-2026-10678 High 8.1 NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller 0.4%
• CVE-2026-10677 Medium 6.5 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool 0.1%
• CVE-2026-10675 Medium 4.3 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS) 0.4%
• CVE-2026-10674 Medium 5.5 DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled 0.1%
• CVE-2026-10673 High 8.3 Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly 0.4%
• CVE-2026-10672 High 8.2 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) 0.6%
• CVE-2026-10671 High 7.1 User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`) 0.2%
• CVE-2026-10670 Medium 5.5 User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier 0.2%
• CVE-2026-10669 High 7.8 Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validation 0.2%
• CVE-2026-10668 Low 2.4 Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver 0.2%
• CVE-2026-10667 High 7.8 SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads 0.1%
• CVE-2026-10666 High 8.1 Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c` 0.7%
• CVE-2026-10665 High 7.4 Heap buffer overflow on WireGuard receive path via unbounded incoming packet length 0.6%
• CVE-2026-10664 Medium 5.0 Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count) 0.2%
• CVE-2026-10663 Medium 6.1 Use-after-free / double-free of the root USB device in the experimental USB host stack 0.2%
• CVE-2026-10660 Medium 6.4 Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption 0.2%
• CVE-2026-10659 Medium 4.7 NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume 0.1%
• CVE-2026-10657 Low 3.7 Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL) 0.4%
• CVE-2026-10656 Medium 4.6 NULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlers 0.3%
• CVE-2026-10655 Medium 6.5 Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it 0.4%
• CVE-2026-10654 Low 3.1 RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic 0.2%
• CVE-2026-10653 Medium 6.4 Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref 0.4%
• CVE-2026-9263 Medium 6.5 Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets 0.3%
• CVE-2026-10652 Medium 4.8 Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`) 0.4%
• CVE-2026-10648 Medium 6.2 NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion 0.2%
• CVE-2026-8023 High 7.5 Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read 0.9%
• CVE-2026-7656 High 8.1 Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack 0.3%
• CVE-2026-10647 Medium 5.3 Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure 0.2%
• CVE-2026-10593 Medium 6.5 Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling 0.4%
• CVE-2026-10646 High 7.4 Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation 0.4%
• CVE-2026-10644 Medium 4.2 Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer 0.2%
• CVE-2026-10643 High 8.7 Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check) 0.2%
• CVE-2026-10642 Medium 6.5 Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control 0.3%
• CVE-2026-10658 High 7.1 Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation 0.3%
• CVE-2026-10651 High 7.1 Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`) 0.3%
• CVE-2026-10645 Medium 4.9 Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image 0.2%
• CVE-2026-10641 High 7.1 Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values) 0.3%
• CVE-2026-10640 Medium 4.2 Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`) 0.4%
• CVE-2026-10639 Medium 4.8 Use-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()` 0.2%