Zephyrproject Security Vulnerabilities (CVEs)

This vulnerability in the GNSS service allows an out-of-bounds write due to incorrect bounds checking. It enables local privilege escalation if an att...

This vulnerability in the GNSS service allows an attacker with System privilege to perform an out-of-bounds write, potentially leading to local privil...

This CVE describes a parameter validation vulnerability in Zephyr RTOS where untrusted input is not properly sanitized before being used in internal o...

This vulnerability allows attackers to spoof BLE connection responses to devices running vulnerable Zephyr RTOS versions. By sending unsolicited conne...

This CVE describes an out-of-bounds write vulnerability in DA (likely a MediaTek component) that could allow local privilege escalation. Attackers wit...

This CVE describes a denial-of-service vulnerability in the DNS implementation that could cause an infinite loop when processing certain DNS responses...

CVE-2025-1675 is an out-of-bounds read vulnerability in the dns_copy_qname function of Zephyr RTOS's DNS implementation. This allows attackers to read...

CVE-2025-1674 is an out-of-bounds read vulnerability in Zephyr RTOS caused by insufficient input validation of network packets. Attackers can exploit ...

CVE-2025-1673 is an out-of-bounds read vulnerability in Zephyr RTOS DNS handling that allows a malicious DNS packet without payload to cause denial of...

This vulnerability in Zephyr RTOS's HTTP server allows buffer overflow attacks due to improper input length validation when processing file extensions...

This vulnerability allows attackers to cause a heap-based buffer overflow in Zephyr RTOS Bluetooth Object Transfer Service (OTS) client by sending mal...

This vulnerability in Zephyr RTOS's UTF-8 string truncation function allows reading memory outside the intended buffer when processing empty strings. ...

This vulnerability in Zephyr RTOS's Bluetooth Host Controller Interface (HCI) allows improper discarding of advertising extension reports, potentially...

This CVE describes a heap-based buffer overflow vulnerability in Zephyr RTOS Bluetooth Classic stack due to missing buffer length checks. Attackers ca...

This vulnerability in Zephyr RTOS Bluetooth stack allows attackers to bypass encryption procedures, potentially enabling unauthorized access to Blueto...

This vulnerability in Zephyr RTOS Bluetooth stack allows attackers to crash devices via a division by zero error when processing malicious LL_CONNECTI...

This vulnerability in Zephyr OS allows IP packets with source or destination addresses of 127.0.0.1 (localhost) to be processed when arriving on exter...

CVE-2023-6881 is a buffer overflow vulnerability in the is_mount_point function in Zephyr RTOS. This vulnerability could allow attackers to execute ar...

This vulnerability in Zephyr RTOS Bluetooth stack allows unauthorized read/write access to Bluetooth characteristics that should require LE Secure Con...

CVE-2023-6249 is an incorrect type conversion vulnerability in the Zephyr RTOS esp32_ipm_send function, where a signed integer is improperly converted...

CVE-2023-5055 is a stack-based buffer overflow vulnerability in the le_ecred_reconf_req function of Zephyr RTOS Bluetooth LE stack. This allows attack...

A buffer overflow vulnerability exists in the Zephyr RTOS IEEE 802.15.4 nRF 15.4 driver, allowing attackers to execute arbitrary code or cause denial ...

This vulnerability in the Zephyr RTOS SJA1000 CAN controller driver causes a fatal exception when attempting automatic bus-off recovery in interrupt c...

A buffer overflow vulnerability exists in the Zephyr RTOS CAN bus subsystem, allowing attackers to execute arbitrary code or cause denial of service. ...

This CVE involves two signed-to-unsigned conversion errors and buffer overflow vulnerabilities in Zephyr RTOS IPM drivers. Successful exploitation cou...

CVE-2023-4264 is a buffer overflow vulnerability in the Zephyr RTOS Bluetooth subsystem that could allow attackers to execute arbitrary code or cause ...

Two buffer overflow vulnerabilities in the Zephyr eS-WiFi driver allow attackers to execute arbitrary code or cause denial of service by sending speci...

This vulnerability allows an attacker to impersonate a legitimate device during Bluetooth mesh provisioning by replaying a previously captured public ...

This vulnerability allows an attacker to write data beyond the intended memory buffer during Bluetooth mesh provisioning in Zephyr, potentially leadin...

This CVE describes a heap-based buffer overflow vulnerability in the USB device class implementation in Zephyr RTOS. Attackers could exploit this to e...

This CVE describes an integer underflow vulnerability in the 6LoWPAN IPHC header uncompression functionality in Zephyr RTOS. An attacker could exploit...

This CVE describes an integer underflow vulnerability in Zephyr's IEEE 802.15.4 fragment reassembly header removal code. When exploited, it can lead t...

This vulnerability in Zephyr's JSON decoder allows attackers to cause memory corruption by exploiting incorrect array-of-array decoding. It affects Ze...

This vulnerability allows attackers to execute arbitrary code or cause denial of service via improper input validation in IEEE 802.15.4 frame processi...

A heap-based buffer overflow vulnerability in Zephyr RTOS's eswifi SPI driver allows attackers to corrupt kernel memory by sending malformed SPI respo...