zephyr.

Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers

• zephyr
• Memory corruption

Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing

• zephyr
• Memory corruption

Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation

• zephyr
• Memory corruption
• Broken access control

6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode

• zephyr
• Memory corruption

PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service

• zephyr
• Denial of service

Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal

• zephyr
• Memory corruption

Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race

• zephyr
• Memory corruption

Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service

• zephyr
• Memory corruption

Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0

• zephyr
• Memory corruption

Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length

• zephyr
• Denial of service

Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)

• zephyr
• Memory corruption

TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

• zephyr
• Race condition

Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention

• zephyr
• CWE-665

Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties

• zephyr
• Memory corruption

Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response

• zephyr
• Memory corruption

NULL pointer dereference in USB DFU device_next download handler (handle_download)

• zephyr
• Memory corruption

Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

• zephyr
• Memory corruption

Cross-thread FPU register leak on ARM when FPU enabled without register sharing

• zephyr
• Information disclosure

Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb)

• zephyr
• Memory corruption

UpdateHub: race condition on shared context causes out-of-bounds write and DoS

• zephyr
• Race condition

Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS

• zephyr
• Denial of service

Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

• zephyr
• Memory corruption

UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata

• zephyr
• Memory corruption

NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)

• zephyr
• Memory corruption

Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write

• zephyr
• Memory corruption

Use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock

• zephyr
• Memory corruption

Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer

• zephyr
• Memory corruption

Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

• zephyr
• Memory corruption

Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

• zephyr
• Memory corruption

PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS

• zephyr
• Denial of service

Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)

• zephyr
• Memory corruption
• CWE-682

Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values

• zephyr
• Broken access control

Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

• zephyr
• Denial of service

Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

• zephyr
• Memory corruption

Out-of-bounds read in coredump shell when printing stored-dump target code

• zephyr
• Memory corruption

DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)

• zephyr
• Denial of service

Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace

• zephyr
• Memory corruption

SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

• zephyr
• Race condition

Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

• zephyr
• Denial of service

Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

• zephyr
• Memory corruption

Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

• zephyr
• Denial of service

NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller

• zephyr
• Memory corruption

Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool

• zephyr
• Denial of service

Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

• zephyr
• Denial of service

DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled

• zephyr
• Denial of service

Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly

• zephyr
• Memory corruption

Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

• zephyr
• Memory corruption

User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)

• zephyr
• Memory corruption

User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier

• zephyr
• Memory corruption

Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validation

• zephyr
• Memory corruption

Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver

• zephyr
• Denial of service

SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads

• zephyr
• Memory corruption

Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

• zephyr
• Memory corruption

Heap buffer overflow on WireGuard receive path via unbounded incoming packet length

• zephyr
• Memory corruption

Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)

• zephyr
• Memory corruption

Use-after-free / double-free of the root USB device in the experimental USB host stack

• zephyr
• Memory corruption

Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption

• zephyr
• Memory corruption

NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume

• zephyr
• Memory corruption

Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)

• zephyr
• Memory corruption

NULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlers

• zephyr
• Memory corruption