Known Vulnerabilities for Zephyr by Zephyrproject-rtos
Listed below are 10 of the newest known vulnerabilities associated with "Zephyr" by "Zephyrproject-rtos".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-13351 json | Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number o... | Not Provided | 2026-06-25 | 2026-06-25 |
| CVE-2026-10774 json | Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth... | Not Provided | 2026-08-02 | 2026-08-03 |
| CVE-2026-10772 json | Rejected reason: ** DUPLICATE ** This CVE Record has been rejected by the Zephyr Project CNA. CVE-2026-10772 was assigned to ... | Not Provided | 2026-08-01 | 2026-08-01 |
| CVE-2026-10687 json | Rejected reason: This CVE Record has been rejected by the Zephyr Project CNA. Subsequent analysis, confirmed with the fix aut... | Not Provided | 2026-06-18 | 2026-06-18 |
| CVE-2026-10686 json | Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branc... | Not Provided | 2026-07-31 | 2026-07-31 |
| CVE-2026-10685 json | The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the ... | Not Provided | 2026-07-31 | 2026-07-31 |
| CVE-2026-10684 json | In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zephyr coredump he... | Not Provided | 2026-07-29 | 2026-07-29 |
| CVE-2026-10682 json | The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed... | Not Provided | 2026-07-27 | 2026-07-27 |
| CVE-2026-10681 json | In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread pe... | Not Provided | 2026-07-25 | 2026-07-27 |
| CVE-2026-10679 json | The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->freq... | Not Provided | 2026-07-21 | 2026-07-22 |