CVE-2021-3329: zephyrproject-rtos zephyr
CVSS: 9.6v3.1CriticalModified
Published 26-02-2023Last modified 11-03-2025
Vulnerability summary
CVE-2021-3329 is a critical (CVSS 9.6) vulnerability in zephyrproject-rtos zephyr. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.6/10
010
Critical · v3.1 (CVE.org)EPSS score
0.62%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 26-02-2023PublishedVulnerability first disclosed.
- 11-03-2025Last modifiedVulnerability information updated.
Description
Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:HSources2 sources · 6.5–9.6
- NVDNIST6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.62% on 20-09-2026
20-09-202620-10-2026
EPSS score0.62%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (zephyrprojectsec.atlassian.net)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-703Improper Check or Handling of Exceptional ConditionsThe product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
- CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Affected systems
Zephyrproject1 product
- zephyr2.4.0 | 2.4.0:rc1 | 2.4.0:rc2 | 2.4.0:rc3
Zephyrproject-rtos1 product
- zephyr≥ unspecified, ≤ v2.4
2 vendors · 2 products