zephyrproject-rtos vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-13351 Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packeHigh 7.5 · Jun 25, 2026
• CVE-2026-5068 A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly.High 7.6 · Jun 9, 2026
• CVE-2026-5067 A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header.Critical 9.8 · Jun 9, 2026
• CVE-2026-1679 The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, corHigh 7.3 · Mar 27, 2026
• CVE-2026-1678 dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels.Critical 9.4 · Mar 5, 2026
• CVE-2025-9558 There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c.High 7.6 · Nov 26, 2025
• CVE-2025-9557 ‭An out-of-bound write can lead to an arbitrary code execution.High 7.6 · Nov 26, 2025
• CVE-2025-9408 System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace procesHigh 8.1 · Nov 11, 2025
• CVE-2025-7403 Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero.High 7.6 · Sep 19, 2025
• CVE-2025-10458 Parameters are not validated or sanitized, and are later used in various internal operations.High 7.6 · Sep 19, 2025
• CVE-2025-10456 A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT).High 7.1 · Sep 19, 2025
• CVE-2025-2962 A denial-of-service issue in the dns implemenation could cause an infinite loop.High 7.5 · Jun 24, 2025
• CVE-2025-1675 The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough tHigh 8.2 · Feb 25, 2025
• CVE-2025-1674 A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.High 8.2 · Feb 25, 2025
• CVE-2025-1673 A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.High 8.2 · Feb 25, 2025
• CVE-2024-10395 No proper validation of the length of user input in http_server_get_content_type_from_extension.High 8.6 · Feb 3, 2025
• CVE-2024-8798 No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.High 7.5 · Dec 15, 2024
• CVE-2024-11263 When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is Critical 9.3 · Nov 15, 2024
• CVE-2024-6259 BT: HCI: adv_ext_report Improper discarding in adv_ext_reportHigh 7.6 · Sep 13, 2024
• CVE-2024-6137 BT: Classic: SDP OOB access in get_att_search_listHigh 7.6 · Sep 13, 2024
• CVE-2024-6135 BT:Classic: Multiple missing buf length checksHigh 7.6 · Sep 13, 2024
• CVE-2024-5754 BT: Encryption procedure hostHigh 8.2 · Sep 13, 2024
• CVE-2024-4785 BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by ZeroHigh 7.6 · Aug 19, 2024
• CVE-2023-7060 Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination addrHigh 8.6 · Mar 15, 2024
• CVE-2023-6881 Possible buffer overflow in is_mount_pointHigh 7.3 · Feb 28, 2024