CVE-2026-19741 HIGH 7.5 Zephyr — Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthr… 2026-10-23 CVE-2026-79977 HIGH 8.2 Zephyr — The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could n… 2026-10-23 CVE-2026-79978 LOW 3.6 Zephyr — The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345… 2026-10-23 CVE-2026-79979 HIGH 7.8 Zephyr — The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm… 2026-10-23 CVE-2026-79980 MEDIUM 5.6 Zephyr — The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv… 2026-10-23 CVE-2026-79981 MEDIUM 6.5 Zephyr — The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the reso… 2026-10-23 CVE-2026-79982 HIGH 8.8 Zephyr — The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copi… 2026-10-23 CVE-2026-18748 LOW 3.5 Zephyr — The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte… 2026-10-21 CVE-2026-19676 HIGH 7.8 Zephyr — The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handle… 2026-10-21 CVE-2026-19947 MEDIUM 5.3 Zephyr — The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_g… 2026-10-21 CVE-2026-78116 MEDIUM 5.2 Zephyr — The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evalua… 2026-10-21 CVE-2026-78117 MEDIUM 4.2 Zephyr — The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing H… 2026-10-21 CVE-2026-78118 HIGH 7 Zephyr — The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP s… 2026-10-21 CVE-2026-78119 MEDIUM 6.3 Zephyr — The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/esp… 2026-10-21 CVE-2026-79976 HIGH 7.1 Zephyr — The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-regis… 2026-10-21 CVE-2026-19595 MEDIUM 6.1 Zephyr — The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated i… 2026-10-19 CVE-2026-76787 MEDIUM 5.9 Zephyr — The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl… 2026-10-19 CVE-2026-76788 HIGH 8.8 Zephyr — The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies fro… 2026-10-19 CVE-2026-77684 MEDIUM 5.7 Zephyr — The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c does not release th… 2026-10-19 CVE-2026-19673 HIGH 7.1 Zephyr — ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame… 2026-10-14 CVE-2026-75083 MEDIUM 5.9 Zephyr — The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, c… 2026-10-14 CVE-2026-75084 MEDIUM 6.8 Zephyr — The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO… 2026-10-14 CVE-2026-75085 MEDIUM 4.2 Zephyr — The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a … 2026-10-14 CVE-2026-19939 MEDIUM 6.3 Zephyr — The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the lo… 2026-10-13 CVE-2026-19940 MEDIUM 6.5 Zephyr — The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.… 2026-10-13 CVE-2026-19936 MEDIUM 4.8 Zephyr — The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three … 2026-10-12 CVE-2026-19937 MEDIUM 5.7 Zephyr — The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a… 2026-10-12 CVE-2026-19938 MEDIUM 5.9 Zephyr — The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in su… 2026-10-12 CVE-2026-18418 LOW 3.4 Zephyr — The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of … 2026-10-11 CVE-2026-19576 MEDIUM 6.8 Zephyr — The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's… 2026-10-11 CVE-2026-19577 HIGH 7.1 Zephyr — net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_g… 2026-10-11 CVE-2026-19669 HIGH 7.8 Zephyr — The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fue… 2026-10-11 CVE-2026-19735 MEDIUM 4.8 Zephyr — The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(… 2026-10-11 CVE-2026-19736 HIGH 7.8 Zephyr — The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straigh… 2026-10-11 CVE-2026-19737 MEDIUM 5.5 Zephyr — i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. … 2026-10-11 CVE-2026-19738 MEDIUM 6.5 Zephyr — The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creati… 2026-10-11 CVE-2026-19739 MEDIUM 6.5 Zephyr — The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retai… 2026-10-11 CVE-2026-19740 MEDIUM 6.5 Zephyr — The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains … 2026-10-11 CVE-2026-19935 HIGH 7.5 Zephyr — The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing thr… 2026-10-11 CVE-2026-19569 HIGH 8.8 Zephyr — dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allo… 2026-10-09 CVE-2026-19570 HIGH 8.8 Zephyr — The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a rec… 2026-10-09 CVE-2026-19571 MEDIUM 6.7 Zephyr — The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copi… 2026-10-09 CVE-2026-19574 HIGH 7 Zephyr — The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin … 2026-10-09 CVE-2026-19575 HIGH 7.8 Zephyr — The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/devic… 2026-10-09 CVE-2026-15894 HIGH 8.8 Zephyr — The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies… 2026-10-07 CVE-2026-19186 HIGH 8.1 Zephyr — ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt… 2026-10-07 CVE-2026-19184 HIGH 8.4 Zephyr — The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, w… 2026-10-05 CVE-2026-19185 HIGH 7.8 Zephyr — The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_pay… 2026-10-05 CVE-2026-17053 MEDIUM 4.4 Zephyr — The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. … 2026-10-01 CVE-2026-16513 HIGH 7.8 Zephyr — The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_… 2026-09-28 CVE-2026-18413 HIGH 7.8 Zephyr — The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buff… 2026-09-28 CVE-2026-18414 HIGH 7.8 Zephyr — The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buff… 2026-09-28 CVE-2026-18415 MEDIUM 6.3 Zephyr — ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-… 2026-09-28 CVE-2026-18416 LOW 3.7 Zephyr — The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered r… 2026-09-28 CVE-2026-18417 MEDIUM 6.5 Zephyr — The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_co… 2026-09-28 CVE-2026-18746 MEDIUM 5.9 Zephyr — parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests t… 2026-09-28 CVE-2026-18747 MEDIUM 6.8 Zephyr — The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a… 2026-09-28 CVE-2026-15890 MEDIUM 5.3 Zephyr — The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_tran… 2026-09-21 CVE-2026-17050 MEDIUM 5.7 Zephyr — The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from t… 2026-09-21 CVE-2026-17051 MEDIUM 6 Zephyr — The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message inter… 2026-09-21 CVE-2026-17052 HIGH 7.8 Zephyr — The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timea… 2026-09-21 CVE-2026-17054 MEDIUM 5.3 Zephyr — The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP … 2026-09-21 CVE-2026-16512 LOW 3.1 Zephyr — gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() an… 2026-09-18 CVE-2026-16514 MEDIUM 4.3 Zephyr — gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEE… 2026-09-18 CVE-2026-16515 MEDIUM 4.7 Zephyr — net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppr… 2026-09-18 CVE-2026-14986 MEDIUM 6.8 Zephyr — The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG… 2026-09-14 CVE-2026-15893 MEDIUM 6.5 Zephyr — net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->… 2026-09-14 CVE-2026-15923 MEDIUM 4.6 Zephyr — The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a … 2026-09-14 CVE-2026-15924 MEDIUM 5.9 Zephyr — Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single process-global array, client_… 2026-09-14 CVE-2026-16147 MEDIUM 6.8 Zephyr — The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT trans… 2026-09-14 CVE-2026-16148 MEDIUM 4.6 Zephyr — The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delay… 2026-09-14 CVE-2026-15891 HIGH 7.5 Zephyr — The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway re… 2026-09-13 CVE-2026-15892 MEDIUM 5.3 Zephyr — The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mg… 2026-09-13