zephyrproject-rtos has 6 CVEs on record between 2025 and 2026. The busiest recent month was November 2025 with 4. The median CVSS is 7.0 (high). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-12890Medium· 6.5Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash48CVE-2025-9408High· 8.1System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.45CVE-2025-9558High· 7.6There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c42CVE-2025-9557High· 7.6An out-of-bound write can lead to an arbitrary code execution42CVE-2025-12899Medium· 6.5A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request36
zephyrproject-rtos vulnerabilities
CVEs affecting zephyrproject-rtos, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2025-12899Medium· 6.5A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request
A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds memory read and creates a potential information-leak vulnerability in the net…
CVE-2025-12035Medium· 6.5An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
CVE-2025-9558High· 7.6There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c
There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into the link.rx.buf receiver buffer without any validation on the data size.
CVE-2025-9557High· 7.6An out-of-bound write can lead to an arbitrary code execution
An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to a crash and a resultant denial of service.
CVE-2025-9408High· 8.1System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.
CVE-2025-12890Medium· 6.5PoCImproper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash
Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.