By vendor

Zephyrproject vulnerabilities

Known CVEs affecting Zephyrproject products, prioritized by severity, with SEC.co remediation and detection guidance.

32 published vulnerabilities

• CVE-2026-10643HIGH 8.7

  A flaw in Zephyr's network socket handling allows a local attacker to write beyond the boundary of a caller-supplied buffer when receiving network packets with ancillary data (control messages). The vulnerability stems from incomplete validation of buffer size before writing packet information metadata. An attacker with local user privileges can trigger this by receiving a specially crafted packet, potentially corrupting memory and gaining elevated permissions or crashing the system. The issue affects Zephyr versions 3.6.0 through 4.4.0.

• CVE-2026-7656HIGH 8.1

  A logic error in the Zephyr IPv6 Neighbor Discovery code allows attackers to bypass critical validation checks by exploiting an incorrect boolean operator precedence. When legitimate Neighbor Discovery messages arrive with ICMPv6 code 0 (the normal value), the buggy condition evaluates false, causing the packet to skip all security checks entirely. An adjacent on-link attacker can send forged Router Advertisements to hijack routing, reconfigure DNS, and adjust network timers, or craft fake Neighbor messages to poison the neighbor cache and intercept traffic. Because the Hop Limit 255 verification is bypassed, a sophisticated remote attacker may also exploit this from off-link in certain network topologies. The flaw is purely a validation logic error—not a memory bug—since the underlying packet-parsing functions themselves are bounds-safe.

• CVE-2026-5068HIGH 7.6

  A vulnerability in Zephyr's Bluetooth host stack allows a nearby attacker to crash devices or corrupt memory by sending specially crafted Bluetooth Low Energy (BLE) packets. The flaw occurs when applications enable a feature called segmentation for handling large BLE messages, but configure their memory pools with insufficient space to track incoming data. An attacker within BLE range (typically 10–240 meters depending on device and antenna) can exploit this without any authentication, causing the device to crash or potentially enabling further compromise through heap corruption.

• CVE-2026-13351HIGH 7.5

  Zephyr's IPv6 networking implementation contains a memory leak in its fragment packet handling code. An attacker can send specially crafted fragmented IPv6 packets that cause the network stack to fail to return allocated buffer memory to the system pool. By sending a small number of these malicious packets in succession, an attacker exhausts the limited pool of receive buffers, leaving the device unable to accept any new network traffic. Once buffers are depleted, the device enters a denial-of-service state until rebooted, making it unavailable for its intended purpose.

• CVE-2026-8023HIGH 7.5

  Zephyr's HTTP server has a path-traversal vulnerability in its static file serving feature. When configured to serve files from a specific directory, the server fails to properly validate request paths, allowing an attacker to use sequences like ../../ to escape the intended directory and read arbitrary files on the system. An unauthenticated remote attacker can exploit this over the network without encryption or authentication—they simply craft a specially-formed HTTP request to retrieve sensitive files they shouldn't have access to.

• CVE-2026-10646HIGH 7.4

  Zephyr's DNS socket implementation contains a use-after-return vulnerability in its getaddrinfo() function. When a DNS query times out and is retried, the code fails to properly clean up the previous query before starting a new one. This leaves a stale callback pointing to an expired stack memory location. When a DNS response arrives—whether from a legitimate delayed resolver or spoofed by an attacker on the network—it triggers the dangling callback, which then writes data into memory that has already been reused by other functions. An attacker can exploit this via crafted or replayed DNS responses to corrupt memory, crash the system, or potentially execute code. This affects Zephyr versions 4.0.0 through 4.4.0.

• CVE-2026-10641HIGH 7.1

  A vulnerability in Zephyr's Bluetooth Classic implementation allows a remote device to crash or corrupt memory on systems running vulnerable builds. When a Zephyr device establishes a Bluetooth connection using the Hands-Free Profile, it expects responses from the remote device that follow a defined format. An attacker controlling or spoofing the remote device can send a malformed response with an unusually long list of indicators, bypassing safety checks and writing data into unintended memory locations. This memory corruption can disable Bluetooth functionality and potentially affect system stability. The vulnerability requires the attacker to be within Bluetooth range and does not require user interaction to trigger.

• CVE-2026-10651HIGH 7.1

  A Bluetooth protocol parser in Zephyr has a boundary-checking flaw that allows a remote device to read one byte past the allocated buffer. When a specially crafted SDP (Service Discovery Protocol) record arrives, the parser validates only that three bytes are present, then immediately tries to read a fourth byte without proper bounds checking. The over-read itself is limited and not exploitable for data theft, but it can crash the device if that fourth byte sits at a memory boundary or trigger a debug assertion. This affects devices running Zephyr 4.3.0 and 4.4.0 and requires no authentication—any paired or nearby Bluetooth peer can send the malicious record.

• CVE-2026-10658HIGH 7.1

  A buffer handling flaw in Zephyr's Bluetooth ISO receive path allows an attacker with access to an established Bluetooth connection to read and write memory beyond buffer boundaries. When processing incoming ISO data packets, the code fails to validate that the packet contains enough bytes before extracting header information. An attacker on a compromised or adjacent Bluetooth device can craft malicious packets to cause out-of-bounds reads that corrupt data structures, and in multi-packet scenarios, trigger out-of-bounds writes that overwrite critical memory regions. The vulnerability affects Zephyr versions 2.6.0 through 4.4.0 when Bluetooth ISO receive functionality is enabled (typically for LE Audio applications).

• CVE-2026-10593MEDIUM 6.5

  A flaw in the Zephyr RTOS Bluetooth LE Audio implementation allows a malicious or misconfigured remote Bluetooth server to crash devices using the BAP (Basic Audio Profile) unicast client. The vulnerability occurs when the remote server sends a state notification at a specific moment in the connection handshake—before the local device has fully set up its audio configuration. At that precise window, the code tries to write data to a memory location that hasn't been initialized, causing the device to crash. The attacker doesn't need any special permissions or interaction from the user; they only need to be connected via Bluetooth.

• CVE-2026-10655MEDIUM 6.5

  A race condition in Zephyr's SNTP (Simple Network Time Protocol) client can cause a networking thread crash when the asynchronous socket close operation runs on a different thread than the socket service's polling thread. An attacker on the network or positioned to intercept traffic can trigger this condition repeatedly by dropping or delaying SNTP responses, causing the system to repeatedly attempt reconnection and hitting the race window. While memory corruption is theoretically possible, denial of service via crash is the primary risk.

• CVE-2026-9263MEDIUM 6.5

  A vulnerability in Zephyr's Bluetooth controller allows a remote attacker to read sensitive memory from a device. The flaw exists in how the system handles Bluetooth ISO (isochronous) data frames. When a specially crafted ISO frame header arrives—either from a connected peer or a broadcaster the device is listening to—the controller fails to validate a length field properly. This causes it to read far more data from memory than it should and send that memory content to the host system as if it were legitimate data, exposing information that shouldn't be accessible. The vulnerability affects all Zephyr versions from 3.0.0 onward that support framed ISO reception.

• CVE-2026-10653MEDIUM 6.4

  Zephyr's network buffer library has a race condition in how it tracks when buffers are no longer in use. The library uses reference counts to know when a buffer can be safely freed, but these counts are updated using regular (non-atomic) operations. When multiple threads or tasks share the same buffer and call the unref function simultaneously, a timing race can cause the library to think two different holders are the last user—leading to the same buffer being freed twice, memory corruption, and potential use-after-free conditions. The vulnerability affects multiple subsystems including networking, Bluetooth, USB, and message passing. Actual exploitation requires genuine concurrency, shared buffer architecture in the application, and precise timing; external attackers have limited ability to trigger it directly.

• CVE-2026-10635MEDIUM 6.3

  CVE-2026-10635 is a use-after-free vulnerability in Zephyr's Xtensa memory domain handling. When a memory domain is destroyed on Xtensa systems with MMU support, the kernel fails to cleanly remove the domain from an internal tracking list, leaving a dangling pointer. If the freed memory is later reused or accessed, kernel code can dereference corrupted data structures, potentially compromising memory isolation between privileged and unprivileged code. The vulnerability requires privileged kernel access to trigger and cannot be exploited directly from user space or remotely.

• CVE-2026-5066MEDIUM 6.3

  A vulnerability exists in Zephyr's TLS socket implementation where attackers with network access and authenticated credentials can trigger an out-of-bounds memory access. When TLS session caching is enabled, the system copies network address data into a fixed buffer without checking if the caller-supplied size matches the actual buffer capacity. An attacker can specify an artificially large address size, causing the copy operation to overwrite adjacent memory. This can crash the system, disrupt network services, or potentially allow code execution if memory corruption is leveraged effectively.

• CVE-2026-5589MEDIUM 6.3

  A flaw in Zephyr's Bluetooth Mesh implementation allows a nearby attacker to send a malicious wireless advertisement that triggers memory corruption. The vulnerable code fails to validate that certain length values are reasonable before using them in calculations, leading to reads and writes far outside intended memory boundaries. Devices with Bluetooth Mesh enabled and the optional proxy server feature active are at risk. No authentication or pairing is required—an attacker simply broadcasts a specially crafted BLE packet.

• CVE-2026-10648MEDIUM 6.2

  A null-pointer dereference vulnerability exists in Zephyr's MCUmgr serial transport handler. When an attacker sends multiple MCUmgr packets in quick succession over a serial/UART connection, they can exhaust the device's shared packet buffer pool (which holds only 4 buffers by default). Once exhausted, the code attempts to reset a null buffer without first checking if allocation succeeded, causing a crash. This is a denial-of-service attack requiring only local serial access; no authentication or user interaction is needed.

• CVE-2026-10637MEDIUM 5.9

  A vulnerability in Zephyr's IPv6 multicast listener discovery (MLD) implementation allows a remote attacker on the local network to crash the networking stack by sending specially crafted MLD queries. The flaw stems from the code attempting to read and modify packet metadata after the packet has been freed by the network driver, creating a use-after-free condition. An attacker can trigger this without authentication by sending a valid MLDv2 General Query to the device, reliably causing a denial of service.

• CVE-2026-10638MEDIUM 5.9

  A use-after-free vulnerability exists in Zephyr's ICMPv6 network stack. When the kernel sends an ICMPv6 response (such as a reply to a ping or an error message), it tries to update statistics using a packet pointer after that packet has already been freed and returned to memory. An attacker on the network can trigger this by sending a simple ICMPv6 Echo Request or crafting packets that cause IPv6 errors, causing the device to crash or potentially corrupt memory. The flaw affects Zephyr versions roughly 4.2.0 through 4.4.0 when IPv6 networking is enabled.

• CVE-2026-10647MEDIUM 5.3

  A bug in the Zephyr RTOS USB network driver causes the device to freeze and lose network connectivity when the USB host suspends the bus while the Zephyr device is trying to send data. The driver fails silently when the USB hardware rejects a transmission request, then waits forever for a completion signal that never arrives, effectively deadlocking the network stack. Recovery requires a reboot. This is a denial-of-service issue affecting any Zephyr device using USB-based networking that connects to a typical host that implements USB suspend (such as a PC entering sleep mode).

• CVE-2026-10645MEDIUM 4.9

  Zephyr's ext2 filesystem driver contains memory safety flaws when processing directory entries on ext2-formatted storage devices. An attacker who supplies a crafted ext2 image—via USB drive, SD card, or mounted file—can trigger out-of-bounds reads that leak kernel heap memory, cause the system to hang indefinitely, or corrupt memory. Any filesystem operation (opening files, listing directories, deleting files, renaming) on the malicious volume triggers the defect. The vulnerability affects all Zephyr versions from 3.5.0 through 4.4.0.

• CVE-2026-10634MEDIUM 4.8

  A race condition in Zephyr's TCP stack allows an attacker on the local network to crash the system or potentially read sensitive memory. The vulnerability exists in how the TCP layer iterates through active connections while a background thread can simultaneously free those connections, causing the iterator to access memory that has already been released. While the attacker needs local network access and user privileges to trigger the issue reliably, the outcome is denial of service or information disclosure on affected embedded and IoT devices running Zephyr.

• CVE-2026-10639MEDIUM 4.8

  Zephyr's IPv4 networking stack contains a use-after-free vulnerability in how it handles ping (ICMP echo) responses. When the device sends back a reply to an incoming ping, it processes the packet through the transmission path, which may immediately free the packet's memory. The code then attempts to read data from that freed memory to update network statistics, creating a window for reading corrupted or recycled data. An attacker can trigger this by sending repeated pings to a Zephyr device, potentially causing statistics corruption or a crash. The vulnerability requires specific configuration options to be enabled and the timing must align with the kernel's memory recycling, making exploitation probabilistic but feasible over a network without authentication.

• CVE-2026-10652MEDIUM 4.8

  A flaw in the Zephyr real-time operating system's DNS resolver allows an attacker to read unintended memory contents from a device. When a malicious or spoofed DNS server sends a specially crafted response with a TXT or SRV record claiming to be larger than it actually is, the resolver reads beyond the DNS response packet into adjacent memory—potentially exposing stale data from prior DNS queries or uninitialized memory pools. An attacker on the network, intercepting DNS traffic, or (if multicast DNS is enabled) any device on the local network can trigger this. The leaked data is typically small (under 64 bytes) and read-only, but in some cases could cause a crash. Zephyr versions 4.3.0 and 4.4.0 are affected.

• CVE-2026-10659MEDIUM 4.7

  A NULL pointer dereference vulnerability exists in Zephyr's Dhara flash translation layer driver. When the driver initializes or mounts a flash-based storage disk, it may attempt to read checkpoint pages to resume the filesystem state. If the flash hardware returns an error (such as a corrected ECC failure or bad block detection), the driver code unconditionally writes the error code through a NULL pointer instead of using the library's safe error-handling function. This causes a kernel fault and system crash. The vulnerability requires local access and depends on specific flash health conditions or crafted on-disk content, making it a localized but critical availability risk for embedded systems relying on Zephyr's flash storage.

• CVE-2026-10642MEDIUM 4.6

  The Zephyr RTOS PL011 UART driver contains a loop that can spin indefinitely when hardware flow control (CTS) is enabled and the connected device stops asserting the CTS signal during data transmission. When this happens, the thread attempting to send data hangs, freezing the entire execution context and breaking serial communication—typically affecting Bluetooth HCI and other serial-dependent subsystems. An attacker with physical or adjacent access to the CTS line (such as by controlling an external Bluetooth module) can trigger this denial of service. Versions 4.1.0 through 4.4.0 are affected; patched releases address the issue by checking CTS status and using the modem-status interrupt to resume when CTS recovers.

• CVE-2026-10656MEDIUM 4.6

  A USB device driver in Zephyr crashes when a USB host performs a legitimate control-transfer abort. The MAX32 USB device controller driver fails to check whether a buffer exists before trying to use it in interrupt handlers. A USB host can trigger this by sending a new SETUP packet to interrupt an in-flight control transfer—standard USB behavior. The result is a device crash (denial of service). No special privileges or authentication are required; physical USB bus access is sufficient. The flaw affects Zephyr v4.4.0 and later versions of the MAX32 UDC driver until patched.

• CVE-2026-10640MEDIUM 4.2

  Zephyr RTOS contains a use-after-free vulnerability in its IPv6 Neighbor Discovery implementation. When a Zephyr device sends IPv6 neighbor advertisement or solicitation messages, the code attempts to update traffic statistics after the network packet has already been freed by the underlying driver. An attacker on the same network segment can trigger this flaw by sending crafted ICMPv6 packets, potentially causing the device to crash or corrupt memory. The vulnerability affects Zephyr versions 3.3.0 through 4.4.0 and requires no authentication—any adjacent device can trigger it.

• CVE-2026-10644MEDIUM 4.2

  A flaw in Microchip's SERCOM-G1 UART driver for PIC32CM-JH microcontrollers causes a one-byte memory write immediately after a receive buffer when asynchronous DMA reception is enabled with a minimal buffer size. An attacker with access to the serial interface can supply data that overwrites one byte in adjacent memory, potentially crashing the device or causing localized corruption. The vulnerability requires specific configuration (async UART mode and single-byte buffer usage) that is not enabled by default, limiting its immediate risk in most deployments.

• CVE-2026-10636LOW 3.7

  Zephyr's IPv4 IGMP implementation contains a use-after-free vulnerability in its packet handling logic. After sending an IGMP message, the code attempts to read network interface information from a packet that may have already been freed and returned to memory pools by the network driver or stack. This can happen because the packet's last reference is released during transmission, but the code still tries to access it afterward. The issue is reachable by sending IGMP membership queries to the multicast address 224.0.0.1, or through local multicast operations, without requiring authentication. The practical result is typically unpredictable system behavior, potential crashes, or corruption of network statistics counters.

• CVE-2026-10657LOW 3.7

  Zephyr's mDNS query handling contains a buffer over-read flaw in its DNS resolver. When checking whether a hostname ends with '.local', the code reads a fixed 7 bytes from the suffix position without verifying the string is long enough. Hostnames ending in shorter suffixes like .org, .com, .io, or a trailing dot cause the comparison to read past the string's null terminator into adjacent memory. On systems with strict memory boundaries (guard pages, memory-domain protections, or address sanitizers), this over-read triggers a crash, resulting in denial of service. The vulnerability only affects devices with mDNS resolver enabled and requires the ability to influence hostname input through configuration, parsed URLs, or application interfaces.

• CVE-2026-10654LOW 3.1

  A race condition in Zephyr's Bluetooth RFCOMM stack can cause a session to become permanently stuck when a local disconnect and an incoming peer disconnect happen at the same time. When this occurs, the session slot doesn't get released properly, preventing future Bluetooth connections with that peer. While the timing required to trigger this is difficult to achieve naturally, repeated occurrences could exhaust available RFCOMM session capacity and deny Bluetooth service to users. The vulnerability only affects availability; no data is leaked or corrupted.