zephyrproject vulnerabilities

Newest CVEs

• CVE-2026-87045

  NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame

  zephyrproject · zephyr

  High7.5
• CVE-2026-87044

  Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service

  zephyrproject · zephyr

  Medium6.5
• CVE-2026-87043

  sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready

  zephyrproject · zephyr

  Medium4.8
• CVE-2026-87041

  Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory

  zephyrproject · zephyr

  High7.8
• CVE-2026-87040

  Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write

  zephyrproject · zephyr

  High8.3
• CVE-2026-87039

  I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers

  zephyrproject · zephyr

  High7.8
• CVE-2026-87038

  Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode

  zephyrproject · zephyr

  High7.0
• CVE-2026-16511

  Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory

  zephyrproject · zephyr

  High8.8
• CVE-2026-85036

  Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue

  zephyrproject · zephyr

  Medium5.7
• CVE-2026-85035

  Use-after-free via dynamically allocated message queue retained by the CAN RX filter

  zephyrproject · zephyr

  High8.8