# zephyr.

Every CVE that names zephyr among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap](https://agentprime.io/advisories/CVE-2026-19569.md)
  `CVE-2026-19569` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Memory corruption
- [ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation](https://agentprime.io/advisories/CVE-2026-19574.md)
  `CVE-2026-19574` · CVE record: zephyrproject zephyr · CVSS 7.0 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer](https://agentprime.io/advisories/CVE-2026-19571.md)
  `CVE-2026-19571` · CVE record: zephyrproject zephyr · CVSS 6.7 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Race condition
- [Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state](https://agentprime.io/advisories/CVE-2026-19570.md)
  `CVE-2026-19570` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Memory corruption
- [Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement](https://agentprime.io/advisories/CVE-2026-15894.md)
  `CVE-2026-15894` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write](https://agentprime.io/advisories/CVE-2026-19186.md)
  `CVE-2026-19186` · CVE record: zephyrproject zephyr · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode](https://agentprime.io/advisories/CVE-2026-19185.md)
  `CVE-2026-19185` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Memory corruption
- [Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch](https://agentprime.io/advisories/CVE-2026-19184.md)
  `CVE-2026-19184` · CVE record: zephyrproject zephyr · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Memory corruption
- [SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state](https://agentprime.io/advisories/CVE-2026-17053.md)
  `CVE-2026-17053` · CVE record: zephyrproject zephyr · CVSS 4.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read](https://agentprime.io/advisories/CVE-2026-18747.md)
  `CVE-2026-18747` · CVE record: zephyrproject zephyr · CVSS 6.8 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted](https://agentprime.io/advisories/CVE-2026-18746.md)
  `CVE-2026-18746` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error](https://agentprime.io/advisories/CVE-2026-18417.md)
  `CVE-2026-18417` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)](https://agentprime.io/advisories/CVE-2026-18416.md)
  `CVE-2026-18416` · CVE record: zephyrproject zephyr · CVSS 3.7 Low · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames](https://agentprime.io/advisories/CVE-2026-18415.md)
  `CVE-2026-18415` · CVE record: zephyrproject zephyr · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation](https://agentprime.io/advisories/CVE-2026-18414.md)
  `CVE-2026-18414` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation](https://agentprime.io/advisories/CVE-2026-18413.md)
  `CVE-2026-18413` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write](https://agentprime.io/advisories/CVE-2026-16513.md)
  `CVE-2026-16513` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly](https://agentprime.io/advisories/CVE-2026-17054.md)
  `CVE-2026-17054` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption
- [AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization](https://agentprime.io/advisories/CVE-2026-15890.md)
  `CVE-2026-15890` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Race condition, CWE-323
- [Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace](https://agentprime.io/advisories/CVE-2026-17052.md)
  `CVE-2026-17052` · CVE record: zephyrproject zephyr · CVSS 7.8 High · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length](https://agentprime.io/advisories/CVE-2026-17051.md)
  `CVE-2026-17051` · CVE record: zephyrproject zephyr · CVSS 6.0 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption
- [Double free of the USB host configuration descriptor when device enumeration fails](https://agentprime.io/advisories/CVE-2026-17050.md)
  `CVE-2026-17050` · CVE record: zephyrproject zephyr · CVSS 5.7 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption
- [ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack](https://agentprime.io/advisories/CVE-2026-16515.md)
  `CVE-2026-16515` · CVE record: zephyrproject zephyr · CVSS 4.7 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-406
- [Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved](https://agentprime.io/advisories/CVE-2026-16514.md)
  `CVE-2026-16514` · CVE record: zephyrproject zephyr · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames](https://agentprime.io/advisories/CVE-2026-16512.md)
  `CVE-2026-16512` · CVE record: zephyrproject zephyr · CVSS 3.1 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction](https://agentprime.io/advisories/CVE-2026-14986.md)
  `CVE-2026-14986` · CVE record: zephyrproject zephyr · CVSS 6.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item](https://agentprime.io/advisories/CVE-2026-16148.md)
  `CVE-2026-16148` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-666
- [it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption](https://agentprime.io/advisories/CVE-2026-16147.md)
  `CVE-2026-16147` · CVE record: zephyrproject zephyr · CVSS 6.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets](https://agentprime.io/advisories/CVE-2026-15924.md)
  `CVE-2026-15924` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS](https://agentprime.io/advisories/CVE-2026-15893.md)
  `CVE-2026-15893` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size](https://agentprime.io/advisories/CVE-2026-15923.md)
  `CVE-2026-15923` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service](https://agentprime.io/advisories/CVE-2026-15892.md)
  `CVE-2026-15892` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service
- [NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway](https://agentprime.io/advisories/CVE-2026-15891.md)
  `CVE-2026-15891` · CVE record: zephyrproject zephyr · CVSS 7.5 High · Not analysed yet · Published 13 Sept 2026 · Tags: Memory corruption
- [Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input](https://agentprime.io/advisories/CVE-2026-15461.md)
  `CVE-2026-15461` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Memory corruption
- [Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path](https://agentprime.io/advisories/CVE-2026-15460.md)
  `CVE-2026-15460` · CVE record: zephyrproject zephyr · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-666
- [IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service](https://agentprime.io/advisories/CVE-2026-14697.md)
  `CVE-2026-14697` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Denial of service
- [Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion](https://agentprime.io/advisories/CVE-2026-14696.md)
  `CVE-2026-14696` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Denial of service
- [Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser](https://agentprime.io/advisories/CVE-2026-14368.md)
  `CVE-2026-14368` · CVE record: zephyrproject zephyr · CVSS 5.4 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Memory corruption, CWE-193
- [I3C IBI work-node free-list data race between ISR and workqueue thread](https://agentprime.io/advisories/CVE-2026-14367.md)
  `CVE-2026-14367` · CVE record: zephyrproject zephyr · CVSS 3.1 Low · Not analysed yet · Published 31 Aug 2026 · Tags: Race condition
- [SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt](https://agentprime.io/advisories/CVE-2026-14366.md)
  `CVE-2026-14366` · CVE record: zephyrproject zephyr · CVSS 6.4 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Memory corruption
- [WireGuard keepalive transport-data messages accepted without Poly1305 authentication](https://agentprime.io/advisories/CVE-2026-13735.md)
  `CVE-2026-13735` · CVE record: zephyrproject zephyr · CVSS 3.7 Low · Not analysed yet · Published 28 Aug 2026 · Tags: Authentication bypass
- [Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack](https://agentprime.io/advisories/CVE-2026-13734.md)
  `CVE-2026-13734` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Authentication bypass
- [Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP](https://agentprime.io/advisories/CVE-2026-13481.md)
  `CVE-2026-13481` · CVE record: zephyrproject zephyr · CVSS 5.4 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Memory corruption
- [Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler](https://agentprime.io/advisories/CVE-2026-13480.md)
  `CVE-2026-13480` · CVE record: zephyrproject zephyr · CVSS 3.1 Low · Not analysed yet · Published 26 Aug 2026 · Tags: Memory corruption, CWE-20
- [Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler](https://agentprime.io/advisories/CVE-2026-13479.md)
  `CVE-2026-13479` · CVE record: zephyrproject zephyr · CVSS 3.1 Low · Not analysed yet · Published 26 Aug 2026 · Tags: Memory corruption
- [Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count](https://agentprime.io/advisories/CVE-2026-13478.md)
  `CVE-2026-13478` · CVE record: zephyrproject zephyr · CVSS 5.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi](https://agentprime.io/advisories/CVE-2026-13217.md)
  `CVE-2026-13217` · CVE record: zephyrproject zephyr · CVSS 5.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length](https://agentprime.io/advisories/CVE-2026-13216.md)
  `CVE-2026-13216` · CVE record: zephyrproject zephyr · CVSS 6.1 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image](https://agentprime.io/advisories/CVE-2026-13215.md)
  `CVE-2026-13215` · CVE record: zephyrproject zephyr · CVSS 6.8 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Stack buffer overflow in OCPP GetConfiguration key parsing](https://agentprime.io/advisories/CVE-2026-13214.md)
  `CVE-2026-13214` · CVE record: zephyrproject zephyr · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register](https://agentprime.io/advisories/CVE-2026-13213.md)
  `CVE-2026-13213` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Memory corruption
- [Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id](https://agentprime.io/advisories/CVE-2026-13212.md)
  `CVE-2026-13212` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-129
- [Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder](https://agentprime.io/advisories/CVE-2026-13343.md)
  `CVE-2026-13343` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure
- [TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory](https://agentprime.io/advisories/CVE-2026-9728.md)
  `CVE-2026-9728` · CVE record: zephyrproject zephyr · CVSS 6.4 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Race condition
- [Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion](https://agentprime.io/advisories/CVE-2026-12999.md)
  `CVE-2026-12999` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2026 · Tags: Denial of service
- [Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length](https://agentprime.io/advisories/CVE-2026-12634.md)
  `CVE-2026-12634` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields](https://agentprime.io/advisories/CVE-2026-12522.md)
  `CVE-2026-12522` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement](https://agentprime.io/advisories/CVE-2026-12633.md)
  `CVE-2026-12633` · CVE record: zephyrproject zephyr · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type](https://agentprime.io/advisories/CVE-2026-12632.md)
  `CVE-2026-12632` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Memory corruption
- [Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel](https://agentprime.io/advisories/CVE-2026-12631.md)
  `CVE-2026-12631` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/technology/zephyr.md>
Older: <https://agentprime.io/advisories/technology/zephyr.md?cursor=WyIyMDI2LTA4LTE4VDIwOjU1OjQyLjg1OTAwMFoiLCJDVkUtMjAyNi0xMjYzMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=zephyr&cursor=WyIyMDI2LTEwLTA5VDA3OjE2OjQ3Ljk5NTAwMFoiLCJDVkUtMjAyNi0xOTU3NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/zephyr/?cursor=WyIyMDI2LTEwLTA5VDA3OjE2OjQ3Ljk5NTAwMFoiLCJDVkUtMjAyNi0xOTU3NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.