VulnSea

zephyr vulnerabilities

CVEs whose affected-version data names the zephyr package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

40 CVEsRSS

CVE-2026-10658High· 7.1
3mo ago

A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data

A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In bt_iso_recv() (subsys/bluetooth/host/iso.c), when processing PB=START/SINGLE fragments, the code pulls a TS SDU head…

▾ Twilightzephyrproject · zephyrEPSS 0.28%via NVD
CVE-2026-10651High· 7.1
3mo ago

A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser

A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In subsys/bluetooth/host/classic/sdp.c, bt_sdp_parse_attribute() accepts an input buffer once it contains the 1-byte attribute type and…

▾ Twilightzephyrproject · zephyrEPSS 0.30%via NVD
CVE-2026-10645Medium· 4.9
3mo ago

Zephyr's ext2 directory-entry parser does not fully validate on-disk directory entry structure before copying the entry name and advancing traversal state

Zephyr's ext2 directory-entry parser does not fully validate on-disk directory entry structure before copying the entry name and advancing traversal state. In ext2_fetch_direntry() (subsys/fs/ext2/ext2_diskops.c), the code only checks de…

▾ Sunlitzephyrproject · zephyrEPSS 0.16%via NVD
CVE-2026-10639Medium· 4.8
3mo ago

In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and then, on success, calls net_stats_update_icmp_sent(net_pkt_iface(reply))

In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and then, on success, calls net_stats_update_icmp_sent(net_pkt_iface(reply)). net…

▾ Sunlitzephyrproject · zephyrEPSS 0.23%via NVD
CVE-2026-10638Medium· 5.9
3mo ago

subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data()

subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data(). In icmpv6_handle_echo_request() and net_icmpv6_send_error(), the post-send statistics update calls net_pkt_iface(…

▾ Sunlitzephyrproject · zephyrEPSS 0.35%via NVD
CVE-2026-10634Medium· 4.8
3mo ago

Zephyr's native TCP stack iterates the global connection list in net_tcp_foreach() (subsys/net/ip/tcp.c) using the SYS_SLIST_FOR_EACH_CONTAINER_SAFE macro, which caches a pointer to the next list node

Zephyr's native TCP stack iterates the global connection list in net_tcp_foreach() (subsys/net/ip/tcp.c) using the SYS_SLIST_FOR_EACH_CONTAINER_SAFE macro, which caches a pointer to the next list node. Prior to this fix the function rele…

▾ Sunlitzephyrproject · zephyrEPSS 0.27%via NVD
CVE-2026-5072Medium· 6.5
4mo ago

A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes

A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes. An attacker sends a crafted PTP_MSG_MANAGEMENT message to set an unvalidated negative log_announce…

▾ Sunlitzephyrproject · zephyrEPSS 0.32%via NVD
CVE-2026-1681Medium· 6.1
4mo ago

Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack

Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the destination is recognized as a local ad…

▾ Sunlitzephyrproject · zephyrEPSS 0.14%via NVD
CVE-2026-1677Medium· 5.3
4mo ago

Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g

Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via `mbedtls_ssl_conf_mi…

▾ Sunlitzephyrproject · zephyrEPSS 0.24%via NVD
CVE-2026-5590Medium· 6.4
5mo ago

A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released

A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context da…

▾ Sunlitzephyrproject · zephyrEPSS 0.27%via NVD
zephyr vulnerabilities (CVEs) — page 2 · VulnSea