# zephyr. Every CVE that names zephyr among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it](https://agentprime.io/advisories/CVE-2026-10655.md) `CVE-2026-10655` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Memory corruption - [RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic](https://agentprime.io/advisories/CVE-2026-10654.md) `CVE-2026-10654` · CVE record: zephyrproject zephyr · CVSS 3.1 Low · Not analysed yet · Published 30 Jun 2026 · Tags: Race condition - [Non-atomic \`net_buf\` reference counts cause double-free / free-list corruption under concurrent unref](https://agentprime.io/advisories/CVE-2026-10653.md) `CVE-2026-10653` · CVE record: zephyrproject zephyr · CVSS 6.4 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Memory corruption - [Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets](https://agentprime.io/advisories/CVE-2026-9263.md) `CVE-2026-9263` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Memory corruption - [Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated \`rdlength\`)](https://agentprime.io/advisories/CVE-2026-10652.md) `CVE-2026-10652` · CVE record: zephyrproject zephyr · CVSS 4.8 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Memory corruption - [NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion](https://agentprime.io/advisories/CVE-2026-10648.md) `CVE-2026-10648` · CVE record: zephyrproject zephyr · CVSS 6.2 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Memory corruption - [Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read](https://agentprime.io/advisories/CVE-2026-8023.md) `CVE-2026-8023` · CVE record: zephyrproject zephyr · CVSS 7.5 High · Not analysed yet · Published 29 Jun 2026 · Tags: Path traversal - [Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack](https://agentprime.io/advisories/CVE-2026-7656.md) `CVE-2026-7656` · CVE record: zephyrproject zephyr · CVSS 8.1 High · Not analysed yet · Published 29 Jun 2026 · Tags: Authentication bypass, CWE-670 - [Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure](https://agentprime.io/advisories/CVE-2026-10647.md) `CVE-2026-10647` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Denial of service - [Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling](https://agentprime.io/advisories/CVE-2026-10593.md) `CVE-2026-10593` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Memory corruption - [Use-after-return in \`zsock_getaddrinfo()\` when a timed-out DNS query is retried without cancellation](https://agentprime.io/advisories/CVE-2026-10646.md) `CVE-2026-10646` · CVE record: zephyrproject zephyr · CVSS 7.4 High · Not analysed yet · Published 28 Jun 2026 · Tags: Memory corruption - [Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer](https://agentprime.io/advisories/CVE-2026-10644.md) `CVE-2026-10644` · CVE record: zephyrproject zephyr · CVSS 4.2 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Memory corruption - [Out-of-bounds heap write in Zephyr \`recvmsg()\` ancillary-data path (\`insert_pktinfo\` undersizes the control-buffer capacity check)](https://agentprime.io/advisories/CVE-2026-10643.md) `CVE-2026-10643` · CVE record: zephyrproject zephyr · CVSS 8.7 High · Not analysed yet · Published 27 Jun 2026 · Tags: Memory corruption - [net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets](https://agentprime.io/advisories/CVE-2026-13351.md) `CVE-2026-13351` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control](https://agentprime.io/advisories/CVE-2026-10642.md) `CVE-2026-10642` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Denial of service - [Out-of-bounds access in Bluetooth ISO receive (\`bt_iso_recv\`) due to missing SDU-header length validation](https://agentprime.io/advisories/CVE-2026-10658.md) `CVE-2026-10658` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: Memory corruption - [Out-of-bounds read in Bluetooth Classic SDP attribute parsing (\`bt_sdp_parse_attribute\`)](https://agentprime.io/advisories/CVE-2026-10651.md) `CVE-2026-10651` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: Denial of service, CWE-20 - [Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image](https://agentprime.io/advisories/CVE-2026-10645.md) `CVE-2026-10645` · CVE record: zephyrproject zephyr · CVSS 4.9 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Memory corruption - [Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)](https://agentprime.io/advisories/CVE-2026-10641.md) `CVE-2026-10641` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Memory corruption - [Use-after-free reading \`net_pkt\` \`iface\` after send in IPv6 Neighbor Discovery (\`ipv6_nbr.c\`)](https://agentprime.io/advisories/CVE-2026-10640.md) `CVE-2026-10640` · CVE record: zephyrproject zephyr · CVSS 4.2 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption - [Use-after-free reading \`net_pkt_iface()\` of a sent ICMPv4 echo-reply packet in \`icmpv4_handle_echo_request()\`](https://agentprime.io/advisories/CVE-2026-10639.md) `CVE-2026-10639` · CVE record: zephyrproject zephyr · CVSS 4.8 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption - [Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error](https://agentprime.io/advisories/CVE-2026-10638.md) `CVE-2026-10638` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption - [Use-after-free of \`net_pkt\` in IPv6 MLD send path triggerable by a link-local MLD Query](https://agentprime.io/advisories/CVE-2026-10637.md) `CVE-2026-10637` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption - [Use-after-free in Zephyr IPv4 IGMP send path (\`igmp_send\`)](https://agentprime.io/advisories/CVE-2026-10636.md) `CVE-2026-10636` · CVE record: zephyrproject zephyr · CVSS 3.7 Low · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption - [Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init](https://agentprime.io/advisories/CVE-2026-10635.md) `CVE-2026-10635` · CVE record: zephyrproject zephyr · CVSS 6.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Memory corruption - [Use-after-free in Zephyr native TCP \`net_tcp_foreach()\` due to dropping \`tcp_lock\` during the callback](https://agentprime.io/advisories/CVE-2026-10634.md) `CVE-2026-10634` · CVE record: zephyrproject zephyr · CVSS 4.8 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Memory corruption - [bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data](https://agentprime.io/advisories/CVE-2026-5068.md) `CVE-2026-5068` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption - [Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key](https://agentprime.io/advisories/CVE-2026-5067.md) `CVE-2026-5067` · CVE record: zephyrproject-rtos Zephyr · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption, CWE-170 - [net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function](https://agentprime.io/advisories/CVE-2026-5066.md) `CVE-2026-5066` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Memory corruption - [Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.](https://agentprime.io/advisories/CVE-2026-5589.md) `CVE-2026-5589` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Memory corruption - [can: Local Denial of Service via SocketCAN Send](https://agentprime.io/advisories/CVE-2026-5071.md) `CVE-2026-5071` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.1 Medium · Not analysed yet · Published 30 May 2026 · Tags: Memory corruption - [ptp: Potential Denial of Service via PTP Interval Shift](https://agentprime.io/advisories/CVE-2026-5072.md) `CVE-2026-5072` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.5 Medium · Not analysed yet · Published 22 May 2026 · Tags: CWE-1335 - [net: Stack Overflow with Ping (to own IP Address) via Shell](https://agentprime.io/advisories/CVE-2026-1681.md) `CVE-2026-1681` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.1 Medium · Not analysed yet · Published 12 May 2026 · Tags: Denial of service - [net: TLS 1.2 connections allowed on TLS 1.3 sockets](https://agentprime.io/advisories/CVE-2026-1677.md) `CVE-2026-1677` · CVE record: zephyrproject-rtos Zephyr · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-757 - [net: ip/tcp: Null pointer dereference can be triggered by a race condition](https://agentprime.io/advisories/CVE-2026-5590.md) `CVE-2026-5590` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.4 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Memory corruption - [net: eswifi socket send payload length not bounded](https://agentprime.io/advisories/CVE-2026-1679.md) `CVE-2026-1679` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.3 High · Not analysed yet · Published 27 Mar 2026 · Tags: Memory corruption - [stm32: usb: Infinite while loop in Interrupt Handler](https://agentprime.io/advisories/CVE-2026-4179.md) `CVE-2026-4179` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.1 Medium · Not analysed yet · Published 14 Mar 2026 · Tags: Denial of service - [crypto: ATAES132A response length allows stack buffer overflow](https://agentprime.io/advisories/CVE-2026-0849.md) `CVE-2026-0849` · CVE record: zephyrproject-rtos Zephyr · CVSS 3.8 Low · Not analysed yet · Published 14 Mar 2026 · Tags: Memory corruption - [dns: memory‑safety issue in the DNS name parser](https://agentprime.io/advisories/CVE-2026-1678.md) `CVE-2026-1678` · CVE record: zephyrproject-rtos Zephyr · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Memory corruption - [net: icmp: Out of bound memory read](https://agentprime.io/advisories/CVE-2025-12899.md) `CVE-2025-12899` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.5 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: Memory corruption - [Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP](https://agentprime.io/advisories/CVE-2025-12035.md) `CVE-2025-12035` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.5 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Memory corruption - [Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont](https://agentprime.io/advisories/CVE-2025-9557.md) `CVE-2025-9557` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 26 Nov 2025 · Tags: Memory corruption - [Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start](https://agentprime.io/advisories/CVE-2025-9558.md) `CVE-2025-9558` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 26 Nov 2025 · Tags: Memory corruption - [Userspace privilege escalation vulnerability on Cortex M](https://agentprime.io/advisories/CVE-2025-9408.md) `CVE-2025-9408` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.2 High · Not analysed yet · Published 11 Nov 2025 · Tags: Privilege escalation - [Bluetooth: peripheral: Invalid handling of malformed connection request](https://agentprime.io/advisories/CVE-2025-12890.md) `CVE-2025-12890` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.5 Medium · Not analysed yet · Published 7 Nov 2025 · Tags: CWE-703 - [Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests](https://agentprime.io/advisories/CVE-2025-10456.md) `CVE-2025-10456` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.1 High · Not analysed yet · Published 19 Sept 2025 · Tags: Memory corruption - [Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values](https://agentprime.io/advisories/CVE-2025-10458.md) `CVE-2025-10458` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-130 - [Bluetooth: bt_conn_tx_processor unsafe handling](https://agentprime.io/advisories/CVE-2025-7403.md) `CVE-2025-7403` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-123 - [Bluetooth: Out-Of-Context le_conn_rsp Handling](https://agentprime.io/advisories/CVE-2025-10457.md) `CVE-2025-10457` · CVE record: zephyrproject-rtos Zephyr · CVSS 4.3 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-358 - [Infinite loop in dns_copy_qname](https://agentprime.io/advisories/CVE-2025-2962.md) `CVE-2025-2962` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.2 High · Not analysed yet · Published 24 Jun 2025 · Tags: Denial of service - [Out of bounds read in dns_copy_qname](https://agentprime.io/advisories/CVE-2025-1675.md) `CVE-2025-1675` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.2 High · Not analysed yet · Published 25 Feb 2025 · Tags: Memory corruption - [Out of bounds read when unpacking DNS answers](https://agentprime.io/advisories/CVE-2025-1674.md) `CVE-2025-1674` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.2 High · Not analysed yet · Published 25 Feb 2025 · Tags: Memory corruption - [Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg](https://agentprime.io/advisories/CVE-2025-1673.md) `CVE-2025-1673` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.2 High · Not analysed yet · Published 25 Feb 2025 · Tags: Memory corruption - [net: lib: http_server: Buffer Under-read](https://agentprime.io/advisories/CVE-2024-10395.md) `CVE-2024-10395` · CVE record: zephyrproject-rtos Zephyr · CVSS 8.6 High · Not analysed yet · Published 3 Feb 2025 · Tags: CWE-127 - [Bluetooth: classic: avdtp: missing buffer length check](https://agentprime.io/advisories/CVE-2024-8798.md) `CVE-2024-8798` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.5 High · Not analysed yet · Published 15 Dec 2024 · Tags: Memory corruption - [arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y](https://agentprime.io/advisories/CVE-2024-11263.md) `CVE-2024-11263` · CVE record: zephyrproject-rtos Zephyr · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Nov 2024 · Tags: Privilege escalation - [Bluetooth: ots: missing buffer length check](https://agentprime.io/advisories/CVE-2024-6444.md) `CVE-2024-6444` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.3 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Memory corruption - [zephyr: out-of-bound read in utf8_trunc](https://agentprime.io/advisories/CVE-2024-6443.md) `CVE-2024-6443` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.3 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Memory corruption - [Bluetooth: ASCS Unchecked tailroom of the response buffer](https://agentprime.io/advisories/CVE-2024-6442.md) `CVE-2024-6442` · CVE record: zephyrproject-rtos Zephyr · CVSS 6.3 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: Memory corruption - [BT: HCI: adv_ext_report Improper discarding in adv_ext_report](https://agentprime.io/advisories/CVE-2024-6259.md) `CVE-2024-6259` · CVE record: zephyrproject-rtos Zephyr · CVSS 7.6 High · Not analysed yet · Published 13 Sept 2024 · Tags: Memory corruption Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .