Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

zephyr — Vulnerabilities & Security Advisories 217

All 217 CVE vulnerabilities found in zephyr, with AI-generated Chinese analysis, references, and POCs.

This page documents known vulnerabilities in Zephyr, an open-source real-time operating system for resource-constrained embedded systems, categorized under common weakness types such as buffer overflows and improper input validation. The collection includes security advisories, flaw reports, and associated technical details ranging from initial public disclosures through to recent updates in the current development cycle, ensuring coverage of both legacy issues and newly identified risks within the Zephyr codebase and its associated components. By reviewing this aggregation, you can track vendor advisories for Zephyr to stay informed about critical patches and mitigation strategies, gain a deeper understanding of specific weakness classes that frequently affect embedded RTOS environments, and investigate a product’s vulnerability history to assess long-term security trends and patch responsiveness. This resource is designed to assist security researchers, developers, and system integrators in evaluating the security posture of Zephyr-based deployments, identifying potential attack surfaces, and aligning internal security protocols with upstream fixes. It serves as a centralized reference for correlating reported flaws with their underlying causes and recommended remediations, facilitating more robust risk management decisions for projects relying on this operating system.

Vendor: zephyrproject-rtos

CVE IDTitleCVSSSeverityPublished
CVE-2026-10634 Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callback CWE-416 4.8 Medium2026-06-15
CVE-2026-5068 bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data CWE-787 7.6 High2026-06-09
CVE-2026-5067 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key CWE-170 9.8 Critical2026-06-09
CVE-2026-5066 net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function CWE-787 6.3 Medium2026-06-04
CVE-2026-5589 Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem. CWE-787--2026-06-04
CVE-2026-5071 can: Local Denial of Service via SocketCAN Send CWE-125 6.1 Medium2026-05-30
CVE-2026-5072 ptp: Potential Denial of Service via PTP Interval Shift --2026-05-22
CVE-2026-1681 net: Stack Overflow with Ping (to own IP Address) via Shell CWE-674 6.1 Medium2026-05-12
CVE-2026-1677 net: TLS 1.2 connections allowed on TLS 1.3 sockets CWE-757 5.3 Medium2026-05-11
CVE-2026-5590 net: ip/tcp: Null pointer dereference can be triggered by a race condition CWE-476 6.4 Medium2026-04-05
CVE-2026-1679 net: eswifi socket send payload length not bounded CWE-120 7.3 High2026-03-27
CVE-2026-4179 stm32: usb: Infinite while loop in Interrupt Handler CWE-835 6.1 Medium2026-03-14
CVE-2026-0849 crypto: ATAES132A response length allows stack buffer overflow CWE-120 3.8 Low2026-03-14
CVE-2026-1678 dns: memory‑safety issue in the DNS name parser CWE-787 9.4 Critical2026-03-05
CVE-2025-12899 net: icmp: Out of bound memory read CWE-843 6.5 Medium2026-01-30
CVE-2025-12035 Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP CWE-190 6.5 Medium2025-12-15
CVE-2025-9557 Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont CWE-120 7.6 High2025-11-26
CVE-2025-9558 Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start CWE-120 7.6 High2025-11-26
CVE-2025-9408 Userspace privilege escalation vulnerability on Cortex M CWE-270 8.2 High2025-11-11
CVE-2025-12890 Bluetooth: peripheral: Invalid handling of malformed connection request CWE-703 6.5 Medium2025-11-07
CVE-2025-10456 Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests CWE-190 7.1 High2025-09-19
CVE-2025-10458 Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values CWE-130 7.6 High2025-09-19
CVE-2025-7403 Bluetooth: bt_conn_tx_processor unsafe handling CWE-123 7.6 High2025-09-19
CVE-2025-10457 Bluetooth: Out-Of-Context le_conn_rsp Handling CWE-358 4.3 Medium2025-09-19
CVE-2025-2962 Infinite loop in dns_copy_qname CWE-835 8.2 High2025-06-24
CVE-2025-1675 Out of bounds read in dns_copy_qname CWE-125 8.2 High2025-02-25
CVE-2025-1674 Out of bounds read when unpacking DNS answers CWE-125 8.2 High2025-02-25
CVE-2025-1673 Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg CWE-125 8.2 High2025-02-25
CVE-2024-10395 net: lib: http_server: Buffer Under-read CWE-127 8.6 High2025-02-03
CVE-2024-8798 Bluetooth: classic: avdtp: missing buffer length check CWE-122 7.5 High2024-12-15

All 217 known CVE vulnerabilities affecting zephyr with full Chinese analysis, references, and POCs where available.