Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 38

Export CSV
CVE-2025-9557

Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont

‭An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to‬ ‭a crash and a resultant denial of service.‬

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Zephyrproject-rtos
Products
Zephyr
CVE-2026-5590

net: ip/tcp: Null pointer dereference can be triggered by a race condition

A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Zephyrproject Zephyrproject-rtos
Products
Zephyr Zephyr
CVE-2026-0849

crypto: ATAES132A response length allows stack buffer overflow

Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Zephyrproject Zephyrproject-rtos
Products
Zephyr Zephyr
CVE-2026-1679

net: eswifi socket send payload length not bounded

The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, corrupting kernel memory (CWE-120). Exploit requires local code that can call the socket send API; no remote attacker can reach it directly.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Zephyrproject Zephyrproject-rtos
Products
Zephyr Zephyr
CVE-2025-10457

Bluetooth: Out-Of-Context le_conn_rsp Handling

The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zephyrproject Zephyrproject-rtos
Products
Zephyr Zephyr
CVE-2025-10456

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Zephyrproject Zephyrproject-rtos
Products
Zephyr Zephyr
CVE-2025-7403

Bluetooth: bt_conn_tx_processor unsafe handling

Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Zephyrproject Zephyrproject-rtos
Products
Zephyr Zephyr
CVE-2024-1638

Bluetooth characteristic LESC security requirement not enforced without additional flags

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Zephyrproject Zephyrproject-rtos
Products
Zephyr Zephyr
CVE-2024-11263

arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y

When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Zephyrproject Zephyrproject-rtos
Products
Zephyr Zephyr