Browse CVEs

MEDIUM 5.9 CVE-2026-10655 The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP socket file descriptor directly from the calling… Zephyr after 4.4.1 Fix from $1,6002026-06-30 HIGH 7.5 CVE-2026-8023 Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTE… Zephyr after 4.4.1 Fix from $1,9502026-06-29 MEDIUM 6.8 CVE-2026-7656 The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expres… Zephyr after 4.4.1 Fix from $1,6002026-06-29 MEDIUM 5.5 CVE-2026-10648 mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before check… Zephyr Patch available Fix from $1,6002026-06-29 MEDIUM 5.3 CVE-2026-10647 The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit cal… Zephyr 4.5.0+ Fix from $1,6002026-06-29 HIGH 7.4 CVE-2026-10646 Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct g… Zephyr after 4.4.1 Fix from $1,9502026-06-28 MEDIUM 6.5 CVE-2026-10593 The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_sta… Zephyr after 4.4.1 Fix from $1,6002026-06-28 HIGH 7.8 CVE-2026-10643 Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_cont… Zephyr after 4.4.1 Fix from $1,9502026-06-28 HIGH 7.5 CVE-2026-13351 Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented… Zephyr after 4.4.1 Fix from $1,9502026-06-25 MEDIUM 6.5 CVE-2026-10642 The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the i… Zephyr 4.5.0+ Fix from $1,6002026-06-24 HIGH 7.1 CVE-2026-10658 bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 by… Zephyr after 4.4.1 Fix from $1,9502026-06-23 MEDIUM 6.5 CVE-2026-10651 bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte a… Zephyr after 4.4.1 Fix from $1,6002026-06-23 MEDIUM 5.5 CVE-2026-10645 The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory blo… Zephyr after 4.4.1 Fix from $1,6002026-06-23 HIGH 7.1 CVE-2026-10641 Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. … Zephyr 3.7.3 / 4.3.1+ Fix from $1,9502026-06-17 HIGH 7.5 CVE-2026-10638 subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_req… Zephyr 4.5.0+ Fix from $1,9502026-06-16 HIGH 7.1 CVE-2026-10640 Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interf… Zephyr 4.5.0+ Fix from $1,9502026-06-16 HIGH 7.1 CVE-2026-10637 subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully. Per the network … Zephyr 4.5.0+ Fix from $1,9502026-06-16 MEDIUM 6.3 CVE-2026-10635 On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domai… Zephyr Patch available Fix from $1,6002026-06-16 MEDIUM 5.3 CVE-2026-10634 Zephyr's native TCP stack iterates the global connection list in net_tcp_foreach() (subsys/net/ip/tcp.c) using the SYS_SLIST_FOR_EACH_CONTAINER_SAFE … Zephyr 4.5.0+ Fix from $1,6002026-06-15 HIGH 8.8 CVE-2026-5068 A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the applic… Zephyr after 4.4.0 Fix from $1,9502026-06-09 CRITICAL 9.8 CVE-2026-5067 A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Ke… Zephyr after 4.3.0 Fix from $2,3002026-06-09 HIGH 8.8 CVE-2026-5066 A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). W… Zephyr after 4.3.0 Fix from $1,9502026-06-04 MEDIUM 6.3 CVE-2026-5589 An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling (subsys/bluetooth/mesh/solicitation.c) leads to an out-of-boun… Zephyr after 4.3.0 Fix from $1,6002026-06-04 HIGH 7.8 CVE-2026-5071 The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in … Zephyr after 4.3.0 Fix from $1,9502026-05-30 MEDIUM 6.5 CVE-2026-5072 A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes. An attacke… Zephyr after 4.3.0 Fix from $1,6002026-05-22 MEDIUM 6.1 CVE-2026-1681 Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path … Zephyr after 4.3.0 Fix from $1,6002026-05-12 MEDIUM 5.3 CVE-2026-1677 Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the soc… Zephyr after 4.3.0 Fix from $1,6002026-05-11 MEDIUM 5.3 CVE-2026-5590 A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() … Zephyr after 4.3.0 Fix from $1,6002026-04-05 HIGH 7.8 CVE-2026-1679 The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi… Zephyr after 4.3.0 Fix from $1,9502026-03-28 MEDIUM 6.1 CVE-2026-4179 Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop. Zephyr after 4.3.0 Fix from $1,6002026-03-16