# zephyr. Every CVE that names zephyr among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers](https://agentprime.io/advisories/CVE-2026-12520.md) `CVE-2026-12520` · CVE record: zephyrproject zephyr · CVSS 6.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption - [Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing](https://agentprime.io/advisories/CVE-2026-12519.md) `CVE-2026-12519` · CVE record: zephyrproject zephyr · CVSS 5.0 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Memory corruption - [Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation](https://agentprime.io/advisories/CVE-2026-9771.md) `CVE-2026-9771` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 17 Aug 2026 · Tags: Memory corruption, Broken access control - [6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode](https://agentprime.io/advisories/CVE-2026-12630.md) `CVE-2026-12630` · CVE record: zephyrproject zephyr · CVSS 4.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Memory corruption - [PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service](https://agentprime.io/advisories/CVE-2026-12629.md) `CVE-2026-12629` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service - [Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal](https://agentprime.io/advisories/CVE-2026-12366.md) `CVE-2026-12366` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 14 Aug 2026 · Tags: Memory corruption - [Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race](https://agentprime.io/advisories/CVE-2026-12365.md) `CVE-2026-12365` · CVE record: zephyrproject zephyr · CVSS 5.8 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Memory corruption - [Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service](https://agentprime.io/advisories/CVE-2026-12364.md) `CVE-2026-12364` · CVE record: zephyrproject zephyr · CVSS 8.4 High · Not analysed yet · Published 14 Aug 2026 · Tags: Memory corruption - [Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0](https://agentprime.io/advisories/CVE-2026-12363.md) `CVE-2026-12363` · CVE record: zephyrproject zephyr · CVSS 4.2 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Memory corruption - [Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length](https://agentprime.io/advisories/CVE-2026-12236.md) `CVE-2026-12236` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)](https://agentprime.io/advisories/CVE-2026-12235.md) `CVE-2026-12235` · CVE record: zephyrproject zephyr · CVSS 6.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Memory corruption - [TOCTOU double-fetch in \`zsock_sendmsg\`/\`recvmsg\` userspace verifiers allows kernel-heap out-of-bounds write](https://agentprime.io/advisories/CVE-2026-12234.md) `CVE-2026-12234` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Race condition - [Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention](https://agentprime.io/advisories/CVE-2026-12233.md) `CVE-2026-12233` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-665 - [Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties](https://agentprime.io/advisories/CVE-2026-12232.md) `CVE-2026-12232` · CVE record: zephyrproject zephyr · CVSS 6.1 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Memory corruption - [Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response](https://agentprime.io/advisories/CVE-2026-12052.md) `CVE-2026-12052` · CVE record: zephyrproject zephyr · CVSS 5.2 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption - [NULL pointer dereference in USB DFU device_next download handler (handle_download)](https://agentprime.io/advisories/CVE-2026-12051.md) `CVE-2026-12051` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption - [Double-free / use-after-free in Realtek BEE Bluetooth HCI driver \`send()\` error paths](https://agentprime.io/advisories/CVE-2026-11894.md) `CVE-2026-11894` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption - [Cross-thread FPU register leak on ARM when FPU enabled without register sharing](https://agentprime.io/advisories/CVE-2026-11985.md) `CVE-2026-11985` · CVE record: zephyrproject zephyr · CVSS 3.6 Low · Not analysed yet · Published 11 Aug 2026 · Tags: Information disclosure - [Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)](https://agentprime.io/advisories/CVE-2026-11893.md) `CVE-2026-11893` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption - [UpdateHub: race condition on shared context causes out-of-bounds write and DoS](https://agentprime.io/advisories/CVE-2026-11812.md) `CVE-2026-11812` · CVE record: zephyrproject zephyr · CVSS 2.5 Low · Not analysed yet · Published 10 Aug 2026 · Tags: Race condition - [Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS](https://agentprime.io/advisories/CVE-2026-11811.md) `CVE-2026-11811` · CVE record: zephyrproject zephyr · CVSS 3.7 Low · Not analysed yet · Published 10 Aug 2026 · Tags: Denial of service - [Out-of-bounds write in DTLS peer Connection ID getsockopt (\`TLS_DTLS_PEER_CID_VALUE\`) in Zephyr net sockets/TLS](https://agentprime.io/advisories/CVE-2026-8718.md) `CVE-2026-8718` · CVE record: zephyrproject zephyr · CVSS 8.4 High · Not analysed yet · Published 10 Aug 2026 · Tags: Memory corruption - [UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata](https://agentprime.io/advisories/CVE-2026-11809.md) `CVE-2026-11809` · CVE record: zephyrproject zephyr · CVSS 3.7 Low · Not analysed yet · Published 10 Aug 2026 · Tags: Memory corruption - [NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)](https://agentprime.io/advisories/CVE-2026-11810.md) `CVE-2026-11810` · CVE record: zephyrproject zephyr · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Memory corruption - [Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write](https://agentprime.io/advisories/CVE-2026-11743.md) `CVE-2026-11743` · CVE record: zephyrproject zephyr · CVSS 6.6 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Memory corruption - [Use-after-free race in kernel \`k_queue_peek_head/tail\` due to missing spinlock](https://agentprime.io/advisories/CVE-2026-11742.md) `CVE-2026-11742` · CVE record: zephyrproject zephyr · CVSS 3.6 Low · Not analysed yet · Published 7 Aug 2026 · Tags: Memory corruption - [Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer](https://agentprime.io/advisories/CVE-2026-11368.md) `CVE-2026-11368` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 4 Aug 2026 · Tags: Memory corruption - [Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body](https://agentprime.io/advisories/CVE-2026-10849.md) `CVE-2026-10849` · CVE record: zephyrproject zephyr · CVSS 8.2 High · Not analysed yet · Published 3 Aug 2026 · Tags: Memory corruption - [Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)](https://agentprime.io/advisories/CVE-2026-10848.md) `CVE-2026-10848` · CVE record: zephyrproject zephyr · CVSS 7.0 High · Not analysed yet · Published 2 Aug 2026 · Tags: Memory corruption - [PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS](https://agentprime.io/advisories/CVE-2026-10774.md) `CVE-2026-10774` · CVE record: zephyrproject zephyr · CVSS 2.4 Low · Not analysed yet · Published 2 Aug 2026 · Tags: Denial of service - [Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)](https://agentprime.io/advisories/CVE-2026-10773.md) `CVE-2026-10773` · CVE record: zephyrproject zephyr · CVSS 5.4 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption, CWE-682 - [Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values](https://agentprime.io/advisories/CVE-2026-2411.md) `CVE-2026-2411` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Broken access control - [Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers](https://agentprime.io/advisories/CVE-2026-10686.md) `CVE-2026-10686` · CVE record: zephyrproject zephyr · CVSS 5.8 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler](https://agentprime.io/advisories/CVE-2026-10685.md) `CVE-2026-10685` · CVE record: zephyrproject zephyr · CVSS 7.6 High · Not analysed yet · Published 31 Jul 2026 · Tags: Memory corruption - [Out-of-bounds read in coredump shell when printing stored-dump target code](https://agentprime.io/advisories/CVE-2026-10684.md) `CVE-2026-10684` · CVE record: zephyrproject zephyr · CVSS 3.0 Low · Not analysed yet · Published 29 Jul 2026 · Tags: Memory corruption - [DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)](https://agentprime.io/advisories/CVE-2026-10683.md) `CVE-2026-10683` · CVE record: zephyrproject zephyr · CVSS 2.4 Low · Not analysed yet · Published 27 Jul 2026 · Tags: Denial of service - [Out-of-bounds write in Zephyr \`log_filter_set\` syscall verifier reachable from userspace](https://agentprime.io/advisories/CVE-2026-10682.md) `CVE-2026-10682` · CVE record: zephyrproject zephyr · CVSS 6.6 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Memory corruption - [SMP race in \`thread_idx_alloc()\` lets concurrent \`k_object_alloc(K_OBJ_THREAD)\` callers share a kernel-object permission slot](https://agentprime.io/advisories/CVE-2026-10681.md) `CVE-2026-10681` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 25 Jul 2026 · Tags: Race condition - [Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image](https://agentprime.io/advisories/CVE-2026-7007.md) `CVE-2026-7007` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service - [Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via \`uint16_t\` length underflow](https://agentprime.io/advisories/CVE-2026-10680.md) `CVE-2026-10680` · CVE record: zephyrproject zephyr · CVSS 7.6 High · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption - [Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)](https://agentprime.io/advisories/CVE-2026-10679.md) `CVE-2026-10679` · CVE record: zephyrproject zephyr · CVSS 3.3 Low · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller](https://agentprime.io/advisories/CVE-2026-10678.md) `CVE-2026-10678` · CVE record: zephyrproject zephyr · CVSS 8.1 High · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption - [Kernel heap memory leak in \`z_vrfy_k_poll()\` lets an unprivileged user thread exhaust the kernel resource pool](https://agentprime.io/advisories/CVE-2026-10677.md) `CVE-2026-10677` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)](https://agentprime.io/advisories/CVE-2026-10675.md) `CVE-2026-10675` · CVE record: zephyrproject zephyr · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled](https://agentprime.io/advisories/CVE-2026-10674.md) `CVE-2026-10674` · CVE record: zephyrproject zephyr · CVSS 5.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly](https://agentprime.io/advisories/CVE-2026-10673.md) `CVE-2026-10673` · CVE record: zephyrproject zephyr · CVSS 8.3 High · Not analysed yet · Published 15 Jul 2026 · Tags: Memory corruption - [Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)](https://agentprime.io/advisories/CVE-2026-10672.md) `CVE-2026-10672` · CVE record: zephyrproject zephyr · CVSS 8.2 High · Not analysed yet · Published 14 Jul 2026 · Tags: Memory corruption - [User thread can re-initialize an in-use \`k_pipe\`, corrupting kernel wait queues (\`CONFIG_USERSPACE\`)](https://agentprime.io/advisories/CVE-2026-10671.md) `CVE-2026-10671` · CVE record: zephyrproject zephyr · CVSS 7.1 High · Not analysed yet · Published 14 Jul 2026 · Tags: Memory corruption - [User-triggerable kernel NULL-pointer dereference (DoS) in \`k_thread_name_copy()\` syscall verifier](https://agentprime.io/advisories/CVE-2026-10670.md) `CVE-2026-10670` · CVE record: zephyrproject zephyr · CVSS 5.5 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Memory corruption - [Xtensa MPU \`arch_buffer_validate()\` integer-overflow lets a user thread bypass syscall pointer validation](https://agentprime.io/advisories/CVE-2026-10669.md) `CVE-2026-10669` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: Memory corruption - [Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver](https://agentprime.io/advisories/CVE-2026-10668.md) `CVE-2026-10668` · CVE record: zephyrproject zephyr · CVSS 2.4 Low · Not analysed yet · Published 12 Jul 2026 · Tags: Denial of service - [SMP use-after-free in Zephyr \`CONFIG_USERSPACE\` dynamic kernel-object tracking, reachable from unprivileged user threads](https://agentprime.io/advisories/CVE-2026-10667.md) `CVE-2026-10667` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 12 Jul 2026 · Tags: Memory corruption - [Stack buffer overflow in \`net_ipaddr_parse()\` IPv4 address-with-port parsing in \`subsys/net/ip/utils.c\`](https://agentprime.io/advisories/CVE-2026-10666.md) `CVE-2026-10666` · CVE record: zephyrproject zephyr · CVSS 8.1 High · Not analysed yet · Published 12 Jul 2026 · Tags: Memory corruption - [Heap buffer overflow on WireGuard receive path via unbounded incoming packet length](https://agentprime.io/advisories/CVE-2026-10665.md) `CVE-2026-10665` · CVE record: zephyrproject zephyr · CVSS 7.4 High · Not analysed yet · Published 12 Jul 2026 · Tags: Memory corruption - [Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)](https://agentprime.io/advisories/CVE-2026-10664.md) `CVE-2026-10664` · CVE record: zephyrproject zephyr · CVSS 5.0 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Memory corruption - [Use-after-free / double-free of the root USB device in the experimental USB host stack](https://agentprime.io/advisories/CVE-2026-10663.md) `CVE-2026-10663` · CVE record: zephyrproject zephyr · CVSS 6.1 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Memory corruption - [Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption](https://agentprime.io/advisories/CVE-2026-10660.md) `CVE-2026-10660` · CVE record: zephyrproject zephyr · CVSS 6.4 Medium · Not analysed yet · Published 11 Jul 2026 · Tags: Memory corruption - [NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume](https://agentprime.io/advisories/CVE-2026-10659.md) `CVE-2026-10659` · CVE record: zephyrproject zephyr · CVSS 4.7 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Memory corruption - [Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)](https://agentprime.io/advisories/CVE-2026-10657.md) `CVE-2026-10657` · CVE record: zephyrproject zephyr · CVSS 3.7 Low · Not analysed yet · Published 5 Jul 2026 · Tags: Memory corruption - [NULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlers](https://agentprime.io/advisories/CVE-2026-10656.md) `CVE-2026-10656` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: Memory corruption Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .