CVE-2026-0849Low· 3.8▾ TwilightPoC availableMalformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 20.9 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.
Zephyr < 4.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-1679High· 7.3net: eswifi socket send payload length not bounded
CVE-2025-9558High· 7.6There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c
CVE-2025-9557High· 7.6An out-of-bound write can lead to an arbitrary code execution
CVE-2026-19570High· 8.8The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without an…
CVE-2026-4179Medium· 6.1stm32: usb: Infinite while loop in Interrupt Handler
CVE-2026-5067Critical· 9.8Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key