zephyrproject vulnerabilities

Newest CVEs

• CVE-2026-85035

  Use-after-free via dynamically allocated message queue retained by the CAN RX filter

  zephyrproject · zephyr

  High8.8
• CVE-2026-85034

  Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers

  zephyrproject · zephyr

  Medium6.7
• CVE-2026-85033

  Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer

  zephyrproject · zephyr

  Medium4.6
• CVE-2026-85032

  Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress

  zephyrproject · zephyr

  Medium4.8
• CVE-2026-82962

  Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet

  zephyrproject · zephyr

  Medium6.5
• CVE-2026-82961

  Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode

  zephyrproject · zephyr

  High7.8
• CVE-2026-82390

  Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver

  zephyrproject · zephyr

  Low3.7
• CVE-2026-82389

  Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference

  zephyrproject · zephyr

  Medium6.5
• CVE-2026-82388

  Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

  zephyrproject · zephyr

  Medium5.3
• CVE-2026-19742

  IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key

  zephyrproject · zephyr

  Low3.7