zephyr.

Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it

• zephyr
• Memory corruption

RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic

• zephyr
• Race condition

Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref

• zephyr
• Memory corruption

Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets

• zephyr
• Memory corruption

Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)

• zephyr
• Memory corruption

NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion

• zephyr
• Memory corruption

Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read

• zephyr
• Path traversal

Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack

• zephyr
• Authentication bypass
• CWE-670

Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure

• zephyr
• Denial of service

Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling

• zephyr
• Memory corruption

Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation

• zephyr
• Memory corruption

Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer

• zephyr
• Memory corruption

Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)

• zephyr
• Memory corruption

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

• Zephyr
• Denial of service

Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control

• zephyr
• Denial of service

Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation

• zephyr
• Memory corruption

Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)

• zephyr
• Denial of service
• CWE-20

Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image

• zephyr
• Memory corruption

Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)

• zephyr
• Memory corruption

Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`)

• zephyr
• Memory corruption

Use-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`

• zephyr
• Memory corruption

Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error

• zephyr
• Memory corruption

Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query

• zephyr
• Memory corruption

Use-after-free in Zephyr IPv4 IGMP send path (`igmp_send`)

• zephyr
• Memory corruption

Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init

• zephyr
• Memory corruption

Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callback

• zephyr
• Memory corruption

bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data

• Zephyr
• Memory corruption

Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

• Zephyr
• Memory corruption
• CWE-170

net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

• Zephyr
• Memory corruption

Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.

• Zephyr
• Memory corruption

can: Local Denial of Service via SocketCAN Send

• Zephyr
• Memory corruption

ptp: Potential Denial of Service via PTP Interval Shift

• Zephyr
• CWE-1335

net: Stack Overflow with Ping (to own IP Address) via Shell

• Zephyr
• Denial of service

net: TLS 1.2 connections allowed on TLS 1.3 sockets

• Zephyr
• CWE-757

net: ip/tcp: Null pointer dereference can be triggered by a race condition

• Zephyr
• Memory corruption

net: eswifi socket send payload length not bounded

• Zephyr
• Memory corruption

stm32: usb: Infinite while loop in Interrupt Handler

• Zephyr
• Denial of service

crypto: ATAES132A response length allows stack buffer overflow

• Zephyr
• Memory corruption

dns: memory‑safety issue in the DNS name parser

• Zephyr
• Memory corruption

net: icmp: Out of bound memory read

• Zephyr
• Memory corruption

Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP

• Zephyr
• Memory corruption

Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont

• Zephyr
• Memory corruption

Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start

• Zephyr
• Memory corruption

Userspace privilege escalation vulnerability on Cortex M

• Zephyr
• Privilege escalation

Bluetooth: peripheral: Invalid handling of malformed connection request

• Zephyr
• CWE-703

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

• Zephyr
• Memory corruption

Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values

• Zephyr
• CWE-130

Bluetooth: bt_conn_tx_processor unsafe handling

• Zephyr
• CWE-123

Bluetooth: Out-Of-Context le_conn_rsp Handling

• Zephyr
• CWE-358

Infinite loop in dns_copy_qname

• Zephyr
• Denial of service

Out of bounds read in dns_copy_qname

• Zephyr
• Memory corruption

Out of bounds read when unpacking DNS answers

• Zephyr
• Memory corruption

Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg

• Zephyr
• Memory corruption

net: lib: http_server: Buffer Under-read

• Zephyr
• CWE-127

Bluetooth: classic: avdtp: missing buffer length check

• Zephyr
• Memory corruption

arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y

• Zephyr
• Privilege escalation

Bluetooth: ots: missing buffer length check

• Zephyr
• Memory corruption

zephyr: out-of-bound read in utf8_trunc

• Zephyr
• Memory corruption

Bluetooth: ASCS Unchecked tailroom of the response buffer

• Zephyr
• Memory corruption

BT: HCI: adv_ext_report Improper discarding in adv_ext_report

• Zephyr
• Memory corruption