Zephyrproject-rtos vulnerabilities
We track 23 vulnerabilities in Zephyrproject-rtos products. 23 are rated high or critical, and none are known to be exploited. The most recent was published on June 25, 2026.
Latest Zephyrproject-rtos vulnerabilities
- 7.5 High severity
Zephyr: Missing Release of Resource after Effective Lifetime
Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network
- 8.8 High severity
Zephyr: Out-of-bounds Write
A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2
- 9.8 Critical severity
Zephyr: Out-of-bounds Write
A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a bounded copy that does no
- 8.8 High severity
Zephyr: Out-of-bounds Write
A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied
- 7.8 High severity
Zephyr: Out-of-bounds Read
The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions ar
- 7.8 High severity
Zephyr: Buffer Copy without Checking Size of Input
The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, corrupting kernel memory (CWE-120). Exploit requires local code that can call the socket send API; no r
- 9.8 Critical severity
Zephyr: Out-of-bounds Write
dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DN
- 7.6 High severity
Zephyr: Buffer Copy without Checking Size of Input
There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into the link.rx.buf receiver buffer without any validation on the data size.
- 7.6 High severity
Zephyr: Buffer Copy without Checking Size of Input
An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to a crash and a resultant denial of service.
- 8.1 High severity
Zephyr: Privilege Context Switching Error
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.
- 8.1 High severity
Zephyr: Improperly Implemented Security Check for Standard
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.
- 9.1 Critical severity
Zephyr: Out-of-bounds Read
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
- 8.2 High severity
Zephyr: Out-of-bounds Read
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
- 8.4 High severity
Zephyr: Privilege Context Switching Error
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
- 7.5 High severity
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external…
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
- 9.1 Critical severity
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC…
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/w
- 8.8 High severity
Zephyr: Buffer Copy without Checking Size of Input
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
- 7.5 High severity
Zephyr: Improper Check or Handling of Exceptional Conditions
The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.
- 8.0 High severity
Zephyr: Use After Free
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on
- 8.0 High severity
Zephyr: Out-of-bounds Write
The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RC
- 7.7 High severity
zephyr: NULL Pointer Dereference
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
- 9.8 Critical severity
zephyr: Always-Incorrect Control Flow Implementation
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
- 7.5 High severity
zephyr: Uncontrolled Resource Consumption
The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traff