Vendor
zephyrproject-rtos
141 known vulnerabilities.
Products
60 results · Clear filters · Feed
-
Medium 6.9
An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. W…
-
Medium 5.5
The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the w…
-
Medium 6.5
The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received…
-
Medium 4.3
bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _…
-
Medium 6.5
The NXP ENET QoS Ethernet driver in drivers/ethernet/eth_nxp_enet_qos serialises transmission with a binary semaphore, …
-
Medium 5.5
When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, each thread stack is mapped into the kernel virtual address space with …
-
Medium 4.6
usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumConfigurati…
-
Medium 4.6
The Renesas RA SCI UART driver's receive-error ISR, uart_ra_sci_eri_isr() in drivers/serial/uart_renesas_ra_sci.c, ackn…
-
Medium 6.3
net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function
A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied…
-
Medium 6.3
Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.
An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling (subsys/bluetooth/mesh/solicitation.c) leads to an out-of-bounds write. When CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled, the function parses solicitation PDUs from raw BLE…
-
Medium 6.1
can: Local Denial of Service via SocketCAN Send
The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions a…
-
Medium 6.5
ptp: Potential Denial of Service via PTP Interval Shift
A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes. An attacker sends a crafted PTP_MSG_MANAGEMENT message to set an unvalidated negative log_announce_interval value in the…
-
Medium 6.1
net: Stack Overflow with Ping (to own IP Address) via Shell
Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the destination is recognized as a local address, both the echo r…
-
Medium 5.3
net: TLS 1.2 connections allowed on TLS 1.3 sockets
Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via `mbedtls_ssl_conf_min_tls_version`). The C…
-
Medium 6.4
net: ip/tcp: Null pointer dereference can be triggered by a race condition
A race condition during TCP connection teardown can cause tcp_recv() to operate on a connection that has already been released. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer derived from stale context data is passed to tcp_ba…
-
Medium 6.1
stm32: usb: Infinite while loop in Interrupt Handler
Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop.
-
Medium 6.5
net: icmp: Out of bound memory read
A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds memory read and creates a potential information-leak vulnerability in the networking subsystem.
-
Medium 6.5
Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP
An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
-
Medium 6.5CVE-2025-12890 Public exploit
Bluetooth: peripheral: Invalid handling of malformed connection request
Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.
-
Medium 4.3
Bluetooth: Out-Of-Context le_conn_rsp Handling
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.
-
Medium 6.3
Bluetooth: ots: missing buffer length check
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
-
Medium 6.3
zephyr: out-of-bound read in utf8_trunc
In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
-
Medium 6.3
Bluetooth: ASCS Unchecked tailroom of the response buffer
In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.
-
Medium 6.3
BT: Unchecked user input in bap_broadcast_assistant
BT: Unchecked user input in bap_broadcast_assistant
-
Medium 6.8
BT: Missing length checks of net_buf in rfcomm_handle_data
BT: Missing length checks of net_buf in rfcomm_handle_data
-
Medium 6.5
bt: host/smp: DoS caused by null pointer dereference
A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device
-
Medium 6.8
Bluetooth: integer underflow in gatt_find_info_rsp
An malicious BLE device can crash BLE victim device by sending malformed gatt packet
-
Medium 4.4
can: out of bounds in remove_rx_filter function
can: out of bounds in remove_rx_filter function
-
Medium 4.4
Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driver
Potential buffer overflow vulnerability at the following location in the Zephyr STM32 Crypto driver
-
Medium 6.3
Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
-
Medium 6.3
Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system.
-
Medium 6.4
Buffer overflow in Zephyr USB
Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_posix.c#L359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usb_dc_native_…
-
Medium 5.9
HCI send_sync Dangling Semaphore Reference Re-use
The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential R…
-
Medium 6.8
BT HCI host union variant confusion
Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.
-
Medium 5.9
HCI Connection Creation Dangling State Reference Re-use
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE o…
-
Medium 5.9
ipv6: Missing ipv6 nullptr-check in handle_ra_input
A missing nullptr-check in handle_ra_input can cause a nullptr-deref.
-
Medium 6.7
net: shell: Improper input validation
At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.
-
Medium 6.8
Buffer Overreads in Bluetooth HCI
A malicious / defective bluetooth controller can cause buffer overreads in the most functions that process HCI command responses.
-
Medium 6.5
Possible to retrieve uncrypted firmware image
There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.
-
Medium 4.0
L2CAP: Information leakage in le_ecred_conn_req()
Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rqh