Zephyrproject Rtos vulnerabilities, page 2
127 vulnerabilities
Known vulnerabilities in Zephyrproject Rtos products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
CVE-2021-3434zephyrproject-rtoszephyr+1
EPSS score0.21%
Stack based buffer overflow in le_ecred_conn_req(). Zephyr versions >= v2.5.0 Stack-based Buffer Overflow (CWE-121). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w87-6rfp-cfrmCVE-2021-3455zephyrproject-rtoszephyr+1EPSS score1.11%
Disconnecting L2CAP channel right after invalid ATT request leads freeze. Zephyr versions >= 2.4.0, >= 2.5.0 contain Use After Free (CWE-416). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7g38-3x9v-v7vpCVE-2025-2962zephyrproject-rtoszephyr+1EPSS score0.57%
A denial-of-service issue in the dns implemenation could cause an infinite loop.CVE-2025-1674zephyrproject-rtoszephyr+1EPSS score0.37%
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.CVE-2025-1673zephyrproject-rtoszephyr+1EPSS score0.35%
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.CVE-2025-1675zephyrproject-rtoszephyr+1EPSS score0.39%
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.CVE-2025-9558zephyrproject-rtoszephyrEPSS score0.19%
There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into the link.rx.buf receiver buffer without any validation on the data size.CVE-2025-9408zephyrproject-rtoszephyrEPSS score0.12%
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.CVE-2025-9557zephyrproject-rtoszephyrEPSS score0.21%
An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to a crash and a resultant denial of service.CVE-2025-7403zephyrproject-rtoszephyr+1EPSS score0.21%
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.CVE-2025-10458zephyrproject-rtoszephyr+1EPSS score0.21%
Parameters are not validated or sanitized, and are later used in various internal operations.CVE-2025-10457zephyrproject-rtoszephyr+1EPSS score0.40%
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.CVE-2025-10456zephyrproject-rtoszephyr+1EPSS score0.21%
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.CVE-2025-12899zephyrproject-rtoszephyrEPSS score0.34%
A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds memory read and creates a potential information-leak vulnerability in the networking subsystem.CVE-2025-12035zephyrproject-rtoszephyrEPSS score0.20%
An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.CVE-2025-12890zephyrproject-rtoszephyrEPSS score0.20%
Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.CVE-2020-13603zephyrproject-rtoszephyr+1EPSS score0.23%
Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-94vp-8gc2-rm45CVE-2020-13601zephyrproject-rtoszephyr+1EPSS score0.93%
Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44CVE-2020-13599zephyrproject-rtoszephyr+1EPSS score0.23%
Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5qhg-j6wc-4f6qCVE-2020-13600zephyrproject-rtoszephyr+1EPSS score0.24%
Malformed SPI in response for eswifi can corrupt kernel memory. Zephyr versions >= 1.14.2, >= 2.3.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hx4p-j86p-2mhr