Zephyr
Source repositories
CVEs (198)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-8798 | Hig | 0.49 | 7.5 | 0.00 | Dec 16, 2024 | No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. | ||
| CVE-2024-6259 | Hig | 0.49 | 7.6 | 0.01 | Sep 13, 2024 | BT: HCI: adv_ext_report Improper discarding in adv_ext_report | ||
| CVE-2024-6137 | Hig | 0.49 | 7.6 | 0.01 | Sep 13, 2024 | BT: Classic: SDP OOB access in get_att_search_list | ||
| CVE-2024-6135 | Hig | 0.49 | 7.6 | 0.00 | Sep 13, 2024 | BT:Classic: Multiple missing buf length checks | ||
| CVE-2024-4785 | Hig | 0.49 | 7.6 | 0.00 | Aug 19, 2024 | BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero | ||
| CVE-2023-4257 | Hig | 0.49 | 7.6 | 0.01 | Oct 13, 2023 | Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. | ||
| CVE-2023-4263 | Hig | 0.49 | 7.6 | 0.00 | Oct 13, 2023 | Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver | ||
| CVE-2023-3725 | Hig | 0.49 | 7.6 | 0.01 | Oct 6, 2023 | Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem | ||
| CVE-2021-3321 | Hig | 0.49 | 7.5 | 0.01 | Oct 12, 2021 | Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions >= >=2.4.0 contain Integer Overflow to Buffer Overflow (CWE-680). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99 | ||
| CVE-2021-3510 | Hig | 0.49 | 7.5 | 0.01 | Oct 5, 2021 | Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-289f-7mw3-2qf4 | ||
| CVE-2026-12364 | Hig | 0.48 | 8.4 | — | Aug 14, 2026 | The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation z_impl_z_log_msg_static_create()… | ||
| CVE-2026-8718 | Hig | 0.48 | 8.4 | 0.00 | Aug 10, 2026 | tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least… | ||
| CVE-2023-6881 | Hig | 0.47 | 7.3 | 0.00 | Feb 29, 2024 | Possible buffer overflow in is_mount_point | ||
| CVE-2022-1841 | Hig | 0.47 | 7.2 | 0.01 | Aug 31, 2022 | In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero. | ||
| CVE-2026-10849 | Hig | 0.46 | 8.2 | 0.00 | Aug 3, 2026 | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). The buffer is sized to hold the received body bytes but reserves no space for a… | ||
| CVE-2026-10678 | Hig | 0.46 | 8.1 | 0.00 | Jul 21, 2026 | The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions… | ||
| CVE-2026-10671 | Hig | 0.46 | 7.1 | 0.00 | Jul 14, 2026 | In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVER_INIT() (which rejects an already-initialized object). As… | ||
| CVE-2026-10666 | Hig | 0.46 | 8.1 | 0.00 | Jul 12, 2026 | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte stack buffer (char ipaddr[NET_IPV4_ADDR_LEN + 1]) using a length of str_len - end - 1, where str_len is the full,… | ||
| CVE-2026-10658 | Hig | 0.46 | 7.1 | 0.00 | Jun 23, 2026 | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf->len. The upstream hci_iso() handler… | ||
| CVE-2026-10651 | Hig | 0.46 | 7.1 | 0.00 | Jun 23, 2026 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the data-element descriptor (type), via… |
- risk 0.49cvss 7.5epss 0.00
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
- risk 0.49cvss 7.6epss 0.01
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
- risk 0.49cvss 7.6epss 0.01
BT: Classic: SDP OOB access in get_att_search_list
- risk 0.49cvss 7.6epss 0.00
BT:Classic: Multiple missing buf length checks
- risk 0.49cvss 7.6epss 0.00
BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
- risk 0.49cvss 7.6epss 0.01
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows.
- risk 0.49cvss 7.6epss 0.00
Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
- risk 0.49cvss 7.6epss 0.01
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem
- risk 0.49cvss 7.5epss 0.01
Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions >= >=2.4.0 contain Integer Overflow to Buffer Overflow (CWE-680). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99
- risk 0.49cvss 7.5epss 0.01
Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-289f-7mw3-2qf4
- risk 0.48cvss 8.4epss —
The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation z_impl_z_log_msg_static_create()…
- risk 0.48cvss 8.4epss 0.00
tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least…
- risk 0.47cvss 7.3epss 0.00
Possible buffer overflow in is_mount_point
- risk 0.47cvss 7.2epss 0.01
In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero.
- risk 0.46cvss 8.2epss 0.00
The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). The buffer is sized to hold the received body bytes but reserves no space for a…
- risk 0.46cvss 8.1epss 0.00
The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions…
- risk 0.46cvss 7.1epss 0.00
In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVER_INIT() (which rejects an already-initialized object). As…
- risk 0.46cvss 8.1epss 0.00
parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte stack buffer (char ipaddr[NET_IPV4_ADDR_LEN + 1]) using a length of str_len - end - 1, where str_len is the full,…
- risk 0.46cvss 7.1epss 0.00
bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf->len. The upstream hci_iso() handler…
- risk 0.46cvss 7.1epss 0.00
bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the data-element descriptor (type), via…
Page 3 of 10