# zephyr. Every CVE that names zephyr among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service](https://agentprime.io/advisories/CVE-2026-87044.md) `CVE-2026-87044` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Denial of service - [sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready](https://agentprime.io/advisories/CVE-2026-87043.md) `CVE-2026-87043` · CVE record: zephyrproject zephyr · CVSS 4.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Weak cryptography or TLS - [Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory](https://agentprime.io/advisories/CVE-2026-87041.md) `CVE-2026-87041` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption - [Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write](https://agentprime.io/advisories/CVE-2026-87040.md) `CVE-2026-87040` · CVE record: zephyrproject zephyr · CVSS 8.3 High · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption - [I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers](https://agentprime.io/advisories/CVE-2026-87039.md) `CVE-2026-87039` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption - [Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode](https://agentprime.io/advisories/CVE-2026-87038.md) `CVE-2026-87038` · CVE record: zephyrproject zephyr · CVSS 7.0 High · Not analysed yet · Published 4 Nov 2026 · Tags: Race condition - [Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory](https://agentprime.io/advisories/CVE-2026-16511.md) `CVE-2026-16511` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption, Broken access control - [Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue](https://agentprime.io/advisories/CVE-2026-85036.md) `CVE-2026-85036` · CVE record: zephyrproject zephyr · CVSS 5.7 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-666 - [Use-after-free via dynamically allocated message queue retained by the CAN RX filter](https://agentprime.io/advisories/CVE-2026-85035.md) `CVE-2026-85035` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption - [Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers](https://agentprime.io/advisories/CVE-2026-85034.md) `CVE-2026-85034` · CVE record: zephyrproject zephyr · CVSS 6.7 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption - [Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer](https://agentprime.io/advisories/CVE-2026-85033.md) `CVE-2026-85033` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-459 - [Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress](https://agentprime.io/advisories/CVE-2026-85032.md) `CVE-2026-85032` · CVE record: zephyrproject zephyr · CVSS 4.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption - [Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packet](https://agentprime.io/advisories/CVE-2026-82962.md) `CVE-2026-82962` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption - [Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode](https://agentprime.io/advisories/CVE-2026-82961.md) `CVE-2026-82961` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption - [Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver](https://agentprime.io/advisories/CVE-2026-82390.md) `CVE-2026-82390` · CVE record: zephyrproject zephyr · CVSS 3.7 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition - [Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference](https://agentprime.io/advisories/CVE-2026-82389.md) `CVE-2026-82389` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption - [Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host](https://agentprime.io/advisories/CVE-2026-82388.md) `CVE-2026-82388` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption - [IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key](https://agentprime.io/advisories/CVE-2026-19742.md) `CVE-2026-19742` · CVE record: zephyrproject zephyr · CVSS 3.7 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Weak cryptography or TLS - [Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses](https://agentprime.io/advisories/CVE-2026-81038.md) `CVE-2026-81038` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service, Memory corruption - [Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity](https://agentprime.io/advisories/CVE-2026-81039.md) `CVE-2026-81039` · CVE record: zephyrproject zephyr · CVSS 4.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service - [Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size](https://agentprime.io/advisories/CVE-2026-79982.md) `CVE-2026-79982` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Memory corruption - [DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing](https://agentprime.io/advisories/CVE-2026-79981.md) `CVE-2026-79981` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS - [Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS](https://agentprime.io/advisories/CVE-2026-79980.md) `CVE-2026-79980` · CVE record: zephyrproject zephyr · CVSS 5.6 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-340 - [Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames](https://agentprime.io/advisories/CVE-2026-79979.md) `CVE-2026-79979` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Memory corruption - [Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path](https://agentprime.io/advisories/CVE-2026-79978.md) `CVE-2026-79978` · CVE record: zephyrproject zephyr · CVSS 3.6 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Memory corruption - [WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr](https://agentprime.io/advisories/CVE-2026-79977.md) `CVE-2026-79977` · CVE record: zephyrproject zephyr · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-346 - [OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)](https://agentprime.io/advisories/CVE-2026-19741.md) `CVE-2026-19741` · CVE record: zephyrproject zephyr · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-1392 - [Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer](https://agentprime.io/advisories/CVE-2026-19947.md) `CVE-2026-19947` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller](https://agentprime.io/advisories/CVE-2026-79976.md) `CVE-2026-79976` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length](https://agentprime.io/advisories/CVE-2026-78119.md) `CVE-2026-78119` · CVE record: zephyrproject zephyr · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP](https://agentprime.io/advisories/CVE-2026-78118.md) `CVE-2026-78118` · CVE record: zephyrproject zephyr · CVSS 7.0 High · Not analysed yet · Published 21 Oct 2026 · Tags: Race condition - [Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air](https://agentprime.io/advisories/CVE-2026-78117.md) `CVE-2026-78117` · CVE record: zephyrproject zephyr · CVSS 4.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Race condition - [Out-of-bounds read in Bluetooth Classic A2DP codec information element handling](https://agentprime.io/advisories/CVE-2026-18748.md) `CVE-2026-18748` · CVE record: zephyrproject zephyr · CVSS 3.5 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path](https://agentprime.io/advisories/CVE-2026-78116.md) `CVE-2026-78116` · CVE record: zephyrproject zephyr · CVSS 5.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode](https://agentprime.io/advisories/CVE-2026-19676.md) `CVE-2026-19676` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service](https://agentprime.io/advisories/CVE-2026-77684.md) `CVE-2026-77684` · CVE record: zephyrproject zephyr · CVSS 5.7 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service - [Zephyr RTIO syscall verifier validates output parameters for read instead of write access](https://agentprime.io/advisories/CVE-2026-19595.md) `CVE-2026-19595` · CVE record: zephyrproject zephyr · CVSS 6.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Memory corruption - [Stack out-of-bounds write in the OSDP Control Panel reply parser](https://agentprime.io/advisories/CVE-2026-76788.md) `CVE-2026-76788` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Memory corruption - [NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum](https://agentprime.io/advisories/CVE-2026-76787.md) `CVE-2026-76787` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Memory corruption - [Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver](https://agentprime.io/advisories/CVE-2026-75085.md) `CVE-2026-75085` · CVE record: zephyrproject zephyr · CVSS 4.2 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption - [Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length](https://agentprime.io/advisories/CVE-2026-75084.md) `CVE-2026-75084` · CVE record: zephyrproject zephyr · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption - [Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header](https://agentprime.io/advisories/CVE-2026-19673.md) `CVE-2026-19673` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption - [Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver](https://agentprime.io/advisories/CVE-2026-75083.md) `CVE-2026-75083` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption - [Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeeping](https://agentprime.io/advisories/CVE-2026-19940.md) `CVE-2026-19940` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption - [Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption](https://agentprime.io/advisories/CVE-2026-19939.md) `CVE-2026-19939` · CVE record: zephyrproject zephyr · CVSS 6.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption - [Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails](https://agentprime.io/advisories/CVE-2026-19938.md) `CVE-2026-19938` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Memory corruption - [Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses](https://agentprime.io/advisories/CVE-2026-19937.md) `CVE-2026-19937` · CVE record: zephyrproject zephyr · CVSS 5.7 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service - [Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference](https://agentprime.io/advisories/CVE-2026-19936.md) `CVE-2026-19936` · CVE record: zephyrproject zephyr · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Race condition - [Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure](https://agentprime.io/advisories/CVE-2026-19740.md) `CVE-2026-19740` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service, CWE-459 - [Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update](https://agentprime.io/advisories/CVE-2026-19739.md) `CVE-2026-19739` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service, CWE-459 - [Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures](https://agentprime.io/advisories/CVE-2026-19738.md) `CVE-2026-19738` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service - [Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown](https://agentprime.io/advisories/CVE-2026-19935.md) `CVE-2026-19935` · CVE record: zephyrproject zephyr · CVSS 7.5 High · Not analysed yet · Published 11 Oct 2026 · Tags: Memory corruption - [NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction](https://agentprime.io/advisories/CVE-2026-19737.md) `CVE-2026-19737` · CVE record: zephyrproject zephyr · CVSS 5.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Memory corruption - [Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name](https://agentprime.io/advisories/CVE-2026-18418.md) `CVE-2026-18418` · CVE record: zephyrproject zephyr · CVSS 3.4 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Memory corruption - [Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths](https://agentprime.io/advisories/CVE-2026-19736.md) `CVE-2026-19736` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Memory corruption - [Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack](https://agentprime.io/advisories/CVE-2026-19735.md) `CVE-2026-19735` · CVE record: zephyrproject zephyr · CVSS 4.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Weak cryptography or TLS - [Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address](https://agentprime.io/advisories/CVE-2026-19577.md) `CVE-2026-19577` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 11 Oct 2026 · Tags: Memory corruption - [Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count](https://agentprime.io/advisories/CVE-2026-19576.md) `CVE-2026-19576` · CVE record: zephyrproject zephyr · CVSS 6.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Memory corruption - [Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode](https://agentprime.io/advisories/CVE-2026-19669.md) `CVE-2026-19669` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Memory corruption - [Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code](https://agentprime.io/advisories/CVE-2026-19575.md) `CVE-2026-19575` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Memory corruption Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .