zephyrproject-rtos Zephyr
127 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-13351 | * – < 3.7.2 ; 4.0.0 – < 4.2.2 ; 4.3.0 – < 4.3.1 | net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets | HIGH 7.5 | 0.5 % | ||
| CVE-2026-5068 | 1.14.0 – < 4.3.1 | bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data | HIGH 8.8 | 0.5 % | ||
| CVE-2026-5067 | 3.7.0 – < 4.3.1 | Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-5066 | * – < 3.7.2 ; 4.0.0 – < 4.2.2 ; 4.3.0 – < 4.3.1 | net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function | HIGH 8.8 | 0.3 % | ||
| CVE-2026-5589 | * – < 4.3.1 | Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem. | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-5071 | * – < 3.7.2 ; 4.0.0 – < 4.2.2 ; 4.3.0 – < 4.3.1 | can: Local Denial of Service via SocketCAN Send | HIGH 7.8 | 0.2 % | ||
| CVE-2026-5072 | * – < 4.3.1 | ptp: Potential Denial of Service via PTP Interval Shift | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-1681 | * – < 4.4.0 | net: Stack Overflow with Ping (to own IP Address) via Shell | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-1677 | * – < 4.4.0 | net: TLS 1.2 connections allowed on TLS 1.3 sockets | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-5590 | * – < 4.3.1 | net: ip/tcp: Null pointer dereference can be triggered by a race condition | MEDIUM 6.4 | 0.2 % | ||
| CVE-2026-1679 | * – < 4.4.0 | net: eswifi socket send payload length not bounded | HIGH 7.8 | 0.2 % | ||
| CVE-2026-4179 | * – < 3.7.2 ; 4.0.0 – < 4.2.2 ; 4.3.0 – < 4.3.1 | stm32: usb: Infinite while loop in Interrupt Handler | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-0849 | * – < 4.4.0 | crypto: ATAES132A response length allows stack buffer overflow | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-1678 | * – < 3.7.2 ; 4.0.0 – < 4.2.2 ; 4.3.0 – < 4.3.1 | dns: memory‑safety issue in the DNS name parser | CRITICAL 9.8 | 0.4 % | ||
| CVE-2025-12899 | * – < 3.7.2 ; 4.0.0 – < 4.2.2 | net: icmp: Out of bound memory read | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-12035 | * – < 4.3.0 | Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-9557 | * – < 4.2.2 | Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont | HIGH 7.6 | 0.2 % | ||
| CVE-2025-9558 | * – < 4.2.2 | Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start | HIGH 7.6 | 0.2 % | ||
| CVE-2025-9408 | * – < 3.7.2 ; 4.0.0 – < 4.2.2 | Userspace privilege escalation vulnerability on Cortex M | HIGH 8.2 | 0.1 % | ||
| CVE-2025-12890 | * – < 4.2.0 | Bluetooth: peripheral: Invalid handling of malformed connection request | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-10456 | * – < 3.7.2 ; 4.0.0 – < 4.3.0 | Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests | HIGH 7.1 | 0.2 % | ||
| CVE-2025-10458 | * – < 4.3.0 | Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values | HIGH 7.6 | 0.2 % | ||
| CVE-2025-7403 | * – < 4.2.0 | Bluetooth: bt_conn_tx_processor unsafe handling | HIGH 7.6 | 0.2 % | ||
| CVE-2025-10457 | * – < 4.3.0 | Bluetooth: Out-Of-Context le_conn_rsp Handling | HIGH 8.1 | 0.4 % | ||
| CVE-2025-2962 | * – < 3.7.2 ; 4.0.0 – < 4.2.0 | Infinite loop in dns_copy_qname | HIGH 8.2 | 0.6 % | ||
| CVE-2025-1675 | * – < 3.7.2 ; 4.0.0 – < 4.1.0 | Out of bounds read in dns_copy_qname | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-1674 | * – < 3.7.2 ; 4.0.0 – < 4.1.0 | Out of bounds read when unpacking DNS answers | HIGH 8.2 | 0.4 % | ||
| CVE-2025-1673 | * – < 3.7.2 ; 4.0.0 – < 4.1.0 | Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg | HIGH 8.2 | 0.4 % | ||
| CVE-2024-10395 | * – 3.7 | net: lib: http_server: Buffer Under-read | HIGH 8.6 | 0.3 % | ||
| CVE-2024-8798 | * – 3.7 | Bluetooth: classic: avdtp: missing buffer length check | HIGH 7.5 | 0.4 % | ||
| CVE-2024-11263 | * – 3.7 | arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y | CRITICAL 9.4 | 0.2 % | ||
| CVE-2024-6444 | * – 3.6 | Bluetooth: ots: missing buffer length check | MEDIUM 6.5 | 0.3 % | ||
| CVE-2024-6443 | * – 3.6 | zephyr: out-of-bound read in utf8_trunc | MEDIUM 6.5 | 0.6 % | ||
| CVE-2024-6442 | * – 3.6 | Bluetooth: ASCS Unchecked tailroom of the response buffer | MEDIUM 6.5 | 0.3 % | ||
| CVE-2024-6259 | * – 3.6 | BT: HCI: adv_ext_report Improper discarding in adv_ext_report | HIGH 7.6 | 0.6 % | ||
| CVE-2024-6137 | * – 3.6 | BT: Classic: SDP OOB access in get_att_search_list | HIGH 7.6 | 0.5 % | ||
| CVE-2024-6135 | * – 3.6 | BT:Classic: Multiple missing buf length checks | HIGH 7.6 | 0.4 % | ||
| CVE-2024-5931 | * – 3.6 | BT: Unchecked user input in bap_broadcast_assistant | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-6258 | * – 3.6 | BT: Missing length checks of net_buf in rfcomm_handle_data | MEDIUM 6.8 | 0.4 % | ||
| CVE-2024-5754 | * – 3.6 | BT: Encryption procedure host vulnerability | HIGH 8.2 | 0.3 % | ||
| CVE-2024-4785 | * – 3.6 | BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero | HIGH 7.6 | 0.5 % | ||
| CVE-2024-3332 | * – 3.6 | bt: host/smp: DoS caused by null pointer dereference | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-3077 | * – 3.6 | Bluetooth: integer underflow in gatt_find_info_rsp | MEDIUM 6.8 | 0.5 % | ||
| CVE-2023-7060 | * – 3.5 | Missing Security Control in Zephyr OS IP Packet Handling | HIGH 8.6 | 0.5 % | ||
| CVE-2023-6881 | * – 3.5 | fs: fuse: buffer overflow vulnerability in the Zephyr FS | CRITICAL 9.8 | 0.4 % | ||
| CVE-2024-1638 | * – 3.5 | Bluetooth characteristic LESC security requirement not enforced without additional flags | CRITICAL 9.1 | 0.4 % | ||
| CVE-2023-5779 | * – 3.5 | can: out of bounds in remove_rx_filter function | CRITICAL 9.8 | 0.4 % | ||
| CVE-2023-6249 | * – 3.5 | ipm: signed to unsigned conversion problem in esp32_ipm_send | CRITICAL 9.8 | 0.4 % | ||
| CVE-2023-6749 | * – 3.5 | Unchecked user input length in the Zephyr Settings Shell | CRITICAL 9.8 | 0.4 % | ||
| CVE-2023-5055 | * – 3.4 | L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req() | CRITICAL 9.8 | 0.8 % | ||
| CVE-2023-4424 | * – < 3.5 | bt: hci: DoS and possible RCE | HIGH 8.8 | 0.4 % | ||
| CVE-2023-5139 | * – < 3.5 | Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driver | HIGH 7.8 | 0.5 % | ||
| CVE-2023-5753 | * – < 3.5 | Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem | HIGH 8.8 | 1.0 % | ||
| CVE-2023-4257 | ≤ 3.4 | Unchecked user input length in the Zephyr WiFi shell module | CRITICAL 9.8 | 1.1 % | ||
| CVE-2023-4263 | ≤ 3.4 | Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver | HIGH 8.8 | 0.5 % | ||
| CVE-2023-5563 | 3.3 – 3.4 | The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECO | HIGH 7.5 | 0.5 % | ||
| CVE-2023-3725 | * – 3.4 | Potential buffer overflow vulnerability in the Zephyr CANbus subsystem | CRITICAL 9.8 | 1.3 % | ||
| CVE-2023-5184 | * – 3.4 | Potential signed to unsigned conversion errors and buffer overflow vulnerabilities in the Zephyr IPM driver | HIGH 8.8 | 0.4 % | ||
| CVE-2023-4260 | ≤ 3.4 | Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem | CRITICAL 10.0 | 0.9 % | ||
| CVE-2023-4264 | ≤ 3.4 | Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem | CRITICAL 9.6 | 1.1 % | ||
| CVE-2023-4259 | 1.14 – < 3.4 | Potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driver | HIGH 8.8 | 0.8 % | ||
| CVE-2023-4258 | 1.14 – 3.4 | bt: mesh: vulnerability in provisioning protocol implementation on provisionee side | HIGH 8.6 | 0.6 % | ||
| CVE-2023-4265 | * – 3.3 | Buffer overflow in Zephyr USB | MEDIUM 6.8 | 0.8 % | ||
| CVE-2023-1901 | * – 3.3 | HCI send_sync Dangling Semaphore Reference Re-use | HIGH 8.0 | 0.6 % | ||
| CVE-2023-2234 | * – 3.3 | BT HCI host union variant confusion | HIGH 8.8 | 0.5 % | ||
| CVE-2023-1902 | * – 3.3 | HCI Connection Creation Dangling State Reference Re-use | HIGH 8.0 | 0.6 % | ||
| CVE-2023-0359 | * – 3.2 ; * – 2.7.4 | ipv6: Missing ipv6 nullptr-check in handle_ra_input | HIGH 7.5 | 0.9 % | ||
| CVE-2023-0779 | unspecified – < v3.3 ; unspecified – v2.7.4 | net: shell: Improper input validation | HIGH 7.7 | 0.5 % | ||
| CVE-2021-3329 | unspecified – v2.4 | DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer | CRITICAL 9.6 | 0.6 % | ||
| CVE-2023-0397 | unspecified – v3.2 | DoS: Invalid Initialization in le_read_buffer_size_complete | CRITICAL 9.6 | 0.5 % | ||
| CVE-2023-0396 | unspecified – v3.2 | Buffer Overreads in Bluetooth HCI | MEDIUM 6.8 | 0.4 % | ||
| CVE-2022-3806 | unspecified – v3.2 | Bluetooth HCI Error Handling Double Free | CRITICAL 9.8 | 1.0 % | ||
| CVE-2022-0553 | unspecified – v3.0 | Possible to retrieve uncrypted firmware image | MEDIUM 6.5 | 0.3 % | ||
| CVE-2021-3966 | unspecified – v3.0 | Usb bluetooth device ACL read cb buffer overflow | CRITICAL 9.6 | 0.5 % | ||
| CVE-2022-2993 | unspecified – v3.1 | bt: host: Wrong key validation check | CRITICAL 9.8 | 0.6 % | ||
| CVE-2022-2741 | unspecified – v3.1 | can: denial-of-service can be triggered by a crafted CAN frame | HIGH 8.2 | 0.7 % | ||
| CVE-2022-1841 | unspecified – v3.0 | Out-of-bound write in tcp_flags | HIGH 7.2 | 0.6 % | ||
| CVE-2022-1042 | unspecified – v3.0 | Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning | HIGH 8.8 | 0.8 % | ||
| CVE-2022-1041 | unspecified – v3.0 | Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning | HIGH 8.8 | 0.9 % | ||
| CVE-2021-3435 | v2.4.0 – < unspecified ; v2.5.0 – < unspecified | L2CAP: Information leakage in le_ecred_conn_req() | MEDIUM 4.0 | 0.2 % | ||
| CVE-2021-3434 | v2.5.0 – < unspecified ; v2.6.0 – < unspecified | L2CAP: Stack based buffer overflow in le_ecred_conn_req() | HIGH 7.8 | 0.2 % | ||
| CVE-2021-3433 | v2.5.0 – < unspecified | BT: Invalid channel map in CONNECT_IND results to Deadlock | MEDIUM 4.0 | 0.2 % | ||
| CVE-2021-3432 | v1.14.0 – < unspecified ; v2.5.0 – < unspecified | BT: Invalid interval in CONNECT_IND leads to Division by Zero | HIGH 7.5 | 0.9 % | ||
| CVE-2021-3431 | v2.5.0 – < unspecified | BT: Assertion failure on repeated LL_FEATURE_REQ | HIGH 7.5 | 0.9 % | ||
| CVE-2021-3430 | v1.14.0 – < unspecified ; v2.5.0 – < unspecified | BT: Assertion failure on repeated LL_CONNECTION_PARAM_REQ | HIGH 7.5 | 0.9 % | ||
| CVE-2021-3861 | v2.6.0 – < unspecified | The RNDIS USB device class includes a buffer overflow vulnerability | HIGH 8.2 | 0.5 % | ||
| CVE-2021-3835 | v2.6.0 – < unspecified | Buffer overflow in usb device class | HIGH 8.8 | 0.7 % | ||
| CVE-2021-3454 | 2.4.0 – < unspecified ; v.2.50 – < unspecified | Truncated L2CAP K-frame causes assertion failure | HIGH 7.5 | 1.0 % | ||
| CVE-2021-3455 | 2.4.0 – < unspecified ; 2.5.0 – < unspecified | Disconnecting L2CAP channel right after invalid ATT request leads freeze | HIGH 7.5 | 1.1 % | ||
| CVE-2021-3330 | >=2.4.0 – < unspecified | RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr | HIGH 8.8 | 0.6 % | ||
| CVE-2021-3323 | >=2.4.0 – < unspecified | Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr | CRITICAL 9.8 | 0.9 % | ||
| CVE-2021-3322 | >=2.4.0 – < unspecified | Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr | MEDIUM 6.5 | 0.5 % | ||
| CVE-2021-3321 | >=2.4.0 – < unspecified | Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal | HIGH 8.8 | 0.8 % | ||
| CVE-2021-3625 | v2.5.0 – < unspecified | Buffer overflow in Zephyr USB DFU DNLOAD | CRITICAL 9.8 | 2.3 % | ||
| CVE-2021-3581 | >=2.5.0 – < unspecified | Buffer Access with Incorrect Length Value in zephyr | HIGH 8.8 | 0.3 % | ||
| CVE-2021-3510 | >1.14.0 – < unspecified ; >2.5.0 – < unspecified | Zephyr JSON decoder incorrectly decodes array of array | HIGH 7.5 | 1.0 % | ||
| CVE-2021-3436 | 1.14.2 – < unspecified ; 2.4.0 – < unspecified ; 2.5.0 – < unspecified | BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-3319 | > v2.4.0 – < unspecified | DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses | CRITICAL 9.8 | 0.9 % | ||
| CVE-2021-3320 | v2.4.0 – < unspecified | Type Confusion in 802154 ACK Frames Handling | HIGH 7.5 | 0.8 % | ||
| CVE-2020-13603 | 1.14.2 – < unspecified ; 2.4.0 – < unspecified | Integer Overflow in memory allocating functions | HIGH 7.8 | 0.2 % | ||
| CVE-2020-13602 | 1.14.2 – < unspecified ; 2.2.0 – < unspecified | Remote Denial of Service in LwM2M do_write_op_tlv | MEDIUM 5.5 | 0.3 % | ||
| CVE-2020-13601 | 1.14.2 – < unspecified ; 2.3.0 – < unspecified | Possible read out of bounds in dns read | CRITICAL 9.8 | 0.9 % | ||
| CVE-2020-13600 | 1.14.2 – < unspecified ; 2.3.0 – < unspecified | Malformed SPI in response for eswifi can corrupt kernel memory | HIGH 7.6 | 0.2 % | ||
| CVE-2020-13599 | 1.14.2 – < unspecified ; 2.3.0 – < unspecified | Security problem with settings and littlefs | LOW 3.3 | 0.2 % | ||
| CVE-2020-13598 | v1.14.2 – < unspecified ; v2.3.0 – < unspecified | FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat | HIGH 7.8 | 0.2 % | ||
| CVE-2020-10072 | v1.14.2 – < unspecified ; v2.2.0 – < unspecified | Improper Handling of Insufficient Permissions or Privileges in zephyr | MEDIUM 5.9 | 0.2 % | ||
| CVE-2020-10069 | v1.14.2 – < unspecified ; v2.2.0 – < unspecified | Zephyr Bluetooth unchecked packet data results in denial of service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2020-10066 | v1.14.2 – < unspecified ; v2.2.0 – < unspecified | Incorrect Error Handling in Bluetooth HCI core | MEDIUM 5.7 | 0.2 % | ||
| CVE-2020-10065 | v1.14.2 – < unspecified ; v2.2.0 – < unspecified | Missing Size Checks in Bluetooth HCI over SPI | HIGH 8.8 | 0.5 % | ||
| CVE-2020-10064 | v1.14.2 – < unspecified ; v2.2.0 – < unspecified | Improper Input Frame Validation in ieee802154 Processing | CRITICAL 9.8 | 0.8 % | ||
| CVE-2020-10071 | 2.2.0 – < unspecified | Insufficient publish message length validation in MQTT | CRITICAL 9.8 | 3.4 % | ||
| CVE-2020-10070 | 2.2.0 – < unspecified | MQTT buffer overflow on receive buffer | CRITICAL 9.8 | 2.9 % | ||
| CVE-2020-10068 | 2.2.0 – < unspecified ; 1.14.0 – < unspecified | Zephyr Bluetooth DLE duplicate requests vulnerability | MEDIUM 6.5 | 0.5 % | ||
| CVE-2020-10063 | 2.2.0 – < unspecified ; 2.1.0 – < unspecified ; 1.14.0 – < unspecified | Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow | HIGH 7.5 | 1.8 % | ||
| CVE-2020-10062 | 2.2.0 – < unspecified | Packet length decoding error in MQTT | CRITICAL 9.8 | 2.9 % | ||
| CVE-2020-10061 | 2.2.0 – < unspecified ; 1.14.0 – < unspecified | Error handling invalid packet sequence | HIGH 8.8 | 0.6 % | ||
| CVE-2020-10067 | 1.14.1 – < unspecified ; 2.1.0 – < unspecified | Integer Overflow In is_in_region Allows User Thread To Access Kernel Memory | HIGH 7.8 | 0.4 % | ||
| CVE-2020-10060 | 2.1.0 – < unspecified ; 2.2.0 – < unspecified | UpdateHub Might Dereference An Uninitialized Pointer | HIGH 8.0 | 1.6 % | ||
| CVE-2020-10059 | 2.1.0 – < unspecified | UpdateHub Module Explicitly Disables TLS Verification | MEDIUM 4.8 | 1.2 % | ||
| CVE-2020-10058 | 2.1.0 – < unspecified | Multiple Syscalls In kscan Subsystem Performs No Argument Validation | HIGH 7.8 | 0.4 % | ||
| CVE-2020-10028 | 1.14.0 – < unspecified ; 2.1.0 – < unspecified | Multiple Syscalls In GPIO Subsystem Performs No Argument Validation | HIGH 7.8 | 0.4 % | ||
| CVE-2020-10027 | 1.14.0 – < unspecified ; 2.1.0 – < unspecified | ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers | HIGH 7.8 | 0.7 % | ||
| CVE-2020-10024 | 1.14.0 – < unspecified ; 2.1.0 – < unspecified | ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers | HIGH 7.8 | 0.7 % | ||
| CVE-2020-10023 | 1.14.0 – < unspecified ; 2.1.0 – < unspecified | Shell Subsystem Contains a Buffer Overflow Vulnerability In shell_spaces_trim | MEDIUM 6.9 | 0.5 % | ||
| CVE-2020-10022 | 2.1.0 – < unspecified ; 2.2.0 – < unspecified | UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array | CRITICAL 9.8 | 2.3 % | ||
| CVE-2020-10021 | 1.14.1 – < unspecified ; 2.1.0 – < unspecified | Out-of-bounds write in USB Mass Storage with unaligned sizes | HIGH 8.1 | 0.4 % | ||
| CVE-2020-10019 | 1.14.1 – < unspecified ; 2.1.0 – < unspecified | Buffer Overflow in USB DFU requested length | HIGH 8.1 | 0.5 % |