Zephyr vulnerabilities
CVEs whose affected-version data names the Zephyr package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
135 CVEsRSS
CVE-2026-1678Critical· 9.4PoCdns: memory‑safety issue in the DNS name parser
dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (d…
CVE-2025-12899Medium· 6.5A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request
A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds memory read and creates a potential information-leak vulnerability in the net…
CVE-2025-12035Medium· 6.5An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
CVE-2025-9558High· 7.6There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c
There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into the link.rx.buf receiver buffer without any validation on the data size.
CVE-2025-9557High· 7.6An out-of-bound write can lead to an arbitrary code execution
An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to a crash and a resultant denial of service.
CVE-2025-9408High· 8.1System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.
CVE-2025-12890Medium· 6.5PoCImproper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash
Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.
CVE-2025-7403High· 7.6Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.
CVE-2025-10458High· 7.6Parameters are not validated or sanitized, and are later used in various internal operations.
Parameters are not validated or sanitized, and are later used in various internal operations.
CVE-2025-10457Medium· 4.3The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.
CVE-2025-10456High· 7.1A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT)
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to dis…
CVE-2025-2962High· 7.5A denial-of-service issue in the dns implemenation could cause an infinite loop.
A denial-of-service issue in the dns implemenation could cause an infinite loop.
CVE-2025-1675High· 8.2The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
CVE-2025-1674High· 8.2A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
CVE-2025-1673High· 8.2A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.