Known Vulnerabilities for products from Zephyrproject
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Zephyrproject".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-18416 json | The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path ag... | Not Provided | 2026-09-28 | 2026-10-27 |
| CVE-2026-18415 json | ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit b... | Not Provided | 2026-09-28 | 2026-10-27 |
| CVE-2026-18414 json | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field o... | Not Provided | 2026-09-28 | 2026-10-27 |
| CVE-2026-18413 json | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field o... | Not Provided | 2026-09-28 | 2026-10-27 |
| CVE-2026-16513 json | The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c befo... | Not Provided | 2026-09-28 | 2026-10-27 |
| CVE-2026-13481 json | The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mg... | Not Provided | 2026-08-26 | 2026-08-31 |
| CVE-2026-13480 json | The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_t... | Not Provided | 2026-08-26 | 2026-08-31 |
| CVE-2026-13479 json | The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan... | Not Provided | 2026-08-26 | 2026-08-31 |
| CVE-2026-13351 json | Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number o... | Not Provided | 2026-06-25 | 2026-10-25 |
| CVE-2026-11368 json | The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel vi... | Not Provided | 2026-08-04 | 2026-10-23 |
| CVE-2026-10849 json | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server i... | Not Provided | 2026-08-03 | 2026-10-23 |
| CVE-2026-10848 json | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) u... | Not Provided | 2026-08-02 | 2026-10-23 |
| CVE-2026-10774 json | Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth... | Not Provided | 2026-08-02 | 2026-10-23 |
| CVE-2026-10773 json | The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char *... | Not Provided | 2026-08-01 | 2026-10-23 |
| CVE-2026-10686 json | Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branc... | Not Provided | 2026-07-31 | 2026-10-23 |
| CVE-2026-10685 json | The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the ... | Not Provided | 2026-07-31 | 2026-10-23 |
| CVE-2026-10683 json | In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler ga... | Not Provided | 2026-07-27 | 2026-10-24 |
| CVE-2026-10682 json | The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed... | Not Provided | 2026-07-27 | 2026-10-24 |
| CVE-2026-10681 json | In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread pe... | Not Provided | 2026-07-25 | 2026-10-24 |
| CVE-2026-10680 json | The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2... | Not Provided | 2026-07-21 | 2026-10-24 |