Zephyr
Source repositories
CVEs (198)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-9408 | Hig | 0.53 | 8.1 | 0.00 | Nov 11, 2025 | System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes. | ||
| CVE-2025-1675 | Hig | 0.53 | 8.2 | 0.00 | Feb 25, 2025 | The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data. | ||
| CVE-2025-1674 | Hig | 0.53 | 8.2 | 0.00 | Feb 25, 2025 | A lack of input validation allows for out of bounds reads caused by malicious or malformed packets. | ||
| CVE-2025-1673 | Hig | 0.53 | 8.2 | 0.00 | Feb 25, 2025 | A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation. | ||
| CVE-2024-5754 | Hig | 0.53 | 8.2 | 0.00 | Sep 13, 2024 | BT: Encryption procedure host vulnerability | ||
| CVE-2024-1638 | Hig | 0.53 | 8.2 | 0.00 | Feb 19, 2024 | The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access,… | ||
| CVE-2022-2741 | Hig | 0.53 | 8.2 | 0.01 | Oct 31, 2022 | The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The… | ||
| CVE-2022-1042 | Hig | 0.53 | 8.2 | 0.01 | Jul 26, 2022 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. | ||
| CVE-2022-1041 | Hig | 0.53 | 8.2 | 0.01 | Jul 26, 2022 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. | ||
| CVE-2021-3861 | Hig | 0.53 | 8.2 | 0.00 | Feb 7, 2022 | The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj | ||
| CVE-2021-3835 | Hig | 0.53 | 8.2 | 0.01 | Feb 7, 2022 | Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf | ||
| CVE-2023-6249 | Hig | 0.52 | 8.0 | 0.00 | Feb 18, 2024 | Signed to unsigned conversion esp32_ipm_send | ||
| CVE-2023-6749 | Hig | 0.52 | 8.0 | 0.00 | Feb 18, 2024 | Unchecked length coming from user input in settings shell | ||
| CVE-2020-10071 | Cri | 0.52 | 9.0 | 0.03 | Jun 5, 2020 | The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions. | ||
| CVE-2020-10022 | Cri | 0.52 | 9.0 | 0.02 | May 11, 2020 | A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr… | ||
| CVE-2026-10643 | Hig | 0.50 | 8.7 | 0.00 | Jun 28, 2026 | Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of… | ||
| CVE-2025-9557 | Hig | 0.49 | 7.6 | 0.00 | Nov 26, 2025 | An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to a crash and a resultant denial of service. | ||
| CVE-2025-7403 | Hig | 0.49 | 7.6 | 0.00 | Sep 19, 2025 | Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption. | ||
| CVE-2025-10458 | Hig | 0.49 | 7.6 | 0.00 | Sep 19, 2025 | Parameters are not validated or sanitized, and are later used in various internal operations. | ||
| CVE-2025-2962 | Hig | 0.49 | 7.5 | 0.00 | Jun 24, 2025 | A denial-of-service issue in the dns implemenation could cause an infinite loop. |
- risk 0.53cvss 8.1epss 0.00
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.
- risk 0.53cvss 8.2epss 0.00
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
- risk 0.53cvss 8.2epss 0.00
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
- risk 0.53cvss 8.2epss 0.00
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
- risk 0.53cvss 8.2epss 0.00
BT: Encryption procedure host vulnerability
- risk 0.53cvss 8.2epss 0.00
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access,…
- risk 0.53cvss 8.2epss 0.01
The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The…
- risk 0.53cvss 8.2epss 0.01
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
- risk 0.53cvss 8.2epss 0.01
In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
- risk 0.53cvss 8.2epss 0.00
The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj
- risk 0.53cvss 8.2epss 0.01
Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf
- risk 0.52cvss 8.0epss 0.00
Signed to unsigned conversion esp32_ipm_send
- risk 0.52cvss 8.0epss 0.00
Unchecked length coming from user input in settings shell
- risk 0.52cvss 9.0epss 0.03
The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
- risk 0.52cvss 9.0epss 0.02
A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This could result in a denial of service in the best case, or code execution in the worst case. See NCC-NCC-016 This issue affects: zephyrproject-rtos zephyr…
- risk 0.50cvss 8.7epss 0.00
Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of…
- risk 0.49cvss 7.6epss 0.00
An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to a crash and a resultant denial of service.
- risk 0.49cvss 7.6epss 0.00
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.
- risk 0.49cvss 7.6epss 0.00
Parameters are not validated or sanitized, and are later used in various internal operations.
- risk 0.49cvss 7.5epss 0.00
A denial-of-service issue in the dns implemenation could cause an infinite loop.
Page 2 of 10