Zephyr

Zephyr RTOS's WireGuard subsystem incorrectly bypasses Poly1305 authentication for keepalive packets, allowing a network attacker to spoof VPN connection status events on affected embedded devices. The flaw in `wg_process_data_message()` accepted any 16-byte type-4 transport-data message and returned before invoking `wg_decrypt_packet()`, meaning the Poly1305 MAC was never verified - only a cleartext receiver-index lookup and a non-cryptographic expiry check were performed. Exploitation is constrained to integrity spoofing of the `NET_EVENT_VPN_CONNECTED` management signal; no traffic injection, key disclosure, or session takeover is possible, and no public exploit has been identified at time of analysis.

Zephyr RTOS's WireGuard VPN receive handler in wg_process_data_message() commits permanent peer-state mutations - endpoint roaming update, liveness timer refresh, and keypair promotion - before validating the anti-replay counter, allowing an on-path attacker who captures a single valid encrypted datagram to replay it from a spoofed source address and hijack the tunnel endpoint. Because AEAD decryption succeeds for any authentic ciphertext regardless of freshness, the spoofed replay is processed as legitimate and irreversibly alters peer state before the replay check fires and returns -EINVAL. No public exploit has been identified at time of analysis; patch is available via upstream commit 260c32ef.

Out-of-bounds read and in-object write in the Zephyr RTOS IEEE 1588 PTP stack affects all Zephyr versions with CONFIG_PTP enabled, exploitable by any unauthenticated attacker with Layer 2 adjacency. The PTP_MGMT_TIME management-id case in tlv_mgmt_post_recv() omits the length guard present for every sibling case, allowing a crafted short TLV to drive an 8-byte over-read and bounded write-back within the same struct ptp_msg allocation. No public exploit has been identified at time of analysis, and impact is constrained to minor adjacent-memory disclosure and corruption of the device's parsed management timestamp - no crash or past-allocation corruption is reachable.

Out-of-bounds read in Zephyr RTOS's LoRaWAN TS004 Fragmented Data Block Transport handler allows a party holding valid device session keys to trigger a bounded overread of up to 232 bytes beyond the 255-byte `MacCtx.RxPayload` static buffer, with overread data silently written into decoder buffers and the FUOTA flash image rather than returned to the attacker. The vulnerable function `frag_transport_package_callback()` in `subsys/lorawan/services/frag_transport.c` casts `rx_buf + rx_pos` to fixed-size structs and passes the pointer to the fragment decoder without first verifying that sufficient payload bytes remain. No public exploit is identified and this CVE is not listed in the CISA KEV catalog; CVSS 3.1 rates the vulnerability 3.1 (Low), reflecting the high-privilege access barrier and constrained, non-disclosing impact.

Out-of-bounds read in Zephyr RTOS's LoRaWAN clock synchronization service allows a malicious or compromised LoRaWAN application server to corrupt the target device's internal time offset by sending a crafted short AppTimeAns frame. The over-read is bounded by a 255-byte static backing buffer so no crash occurs, and the stray bytes are never transmitted back to the attacker, eliminating any information disclosure. Impact is confined to a minor, device-local clock integrity issue - the device's time estimate may silently diverge if a garbage time-correction value happens to match the pending token. No public exploit identified at time of analysis, and no CISA KEV listing.

Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.

NULL pointer dereference in the Zephyr RTOS OCPP 1.6 client allows a malicious or compromised OCPP central system - or a man-in-the-middle on an unencrypted ws:// connection - to remotely crash the OCPP reader thread of an EV charge point by returning a malformed CALLRESULT uid field. Impact is availability-only and platform-conditional: on MMU/MPU-equipped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION-enabled Zephyr targets, the fault invokes the fatal handler and produces a remote denial of service; on bare-metal targets where address 0 is readable, the call returns 0 and is benign. No public exploit is identified at time of analysis, and the vendor-supplied patch at the referenced commits is known to be incomplete - a second unguarded strtok_r/atoi pair in the same function path remains exploitable via a uid containing one token but no second hyphen-delimited segment.

Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.

Out-of-bounds write in Zephyr RTOS's ext2 filesystem driver enables supervisor-mode memory corruption when a device mounts a crafted ext2 image from a physical storage medium such as an SD card. The driver's superblock validation function omits bounds-checking the s_log_block_size field, allowing an attacker-controlled value to produce an inflated block size that silently misconfigures the kernel memory slab allocator beyond its static backing buffer, with impact ranging from denial of service to potential code execution in kernel mode. No confirmed active exploitation or public POC is identified at time of analysis; a vendor patch is available as upstream commit f270f4bd0e59585da31e1fbaa79c5abf73f1364b.

Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.

Zephyr RTOS's Hearing Access Service (HAS) GATT peripheral crashes when a previously bonded Bluetooth peer reconnects during a boot-time race window before bt_has_register() completes service initialization. The security_changed() callback - registered unconditionally via BT_CONN_CB_DEFINE - fires against NULL attribute pointers, triggering either a kernel assertion or a NULL dereference in bt_gatt_is_subscribed(). With CVSS AV:A/AC:H and confirmed DoS-only impact, this represents a medium-severity availability risk against embedded hearing-aid devices running Zephyr 3.6.0 through 4.4.1; no public exploit code has been identified, and a vendor patch is confirmed at 4.4.2.

Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.

Zephyr RTOS versions 4.3.0 through 4.4.1 leak 8 bytes of uninitialised kernel stack memory per MIDI 2.0 discovery request through the UMP Stream responder library. Two reply-packet builder functions declare their result struct without zero-initialisation, causing stale stack contents in the trailing two 32-bit words to be transmitted verbatim over the wire. The default unauthenticated Network MIDI 2.0 UDP endpoint exposes this to any remote peer; the request is freely repeatable, enabling accumulation of stack disclosures. No public exploit has been identified at time of analysis, and KEV status is absent.

Kernel memory disclosure and denial-of-service in Zephyr RTOS's mbox_send() syscall verifier stem from a time-of-check/time-of-use (TOCTOU) race in z_vrfy_mbox_send() (drivers/mbox/mbox_handlers.c), present in versions 3.0.0 through 4.4.2 on CONFIG_USERSPACE builds. An unprivileged userspace thread can race a second thread in the same address space to replace the validated msg->data pointer with a supervisor-mode address after the bounds check completes, causing the underlying driver to perform a supervisor-context read from an attacker-chosen kernel address. The upstream fix (commit ab35eacc) is confirmed available; no public exploit is identified at time of analysis.

Permanent Wi-Fi denial-of-service in the Infineon AIROC driver shipped with Zephyr RTOS 3.6.0 through 4.4.1 allows a Wi-Fi-adjacent attacker to exhaust a fixed 20-buffer transmit/receive pool by inducing repeated synchronous WHD send failures, each of which leaks one buffer from airoc_pool without releasing it. Once the pool is fully exhausted, both transmit and WHD-driven receive paths fail, severing all Wi-Fi connectivity until the device is physically rebooted. No active exploitation is recorded in CISA KEV and no public exploit code has been identified, but the defect can also manifest organically over a device's operational lifetime through ordinary transient failures.

Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.

Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.

Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.

Out-of-bounds stack read and write in the WNC-M14A2A LTE-M modem driver (wncm14a2a.c) within Zephyr RTOS versions 1.13.0 through below 4.4.2 allows a rogue cellular base station or RF attacker to crash the modem RX thread and leak adjacent stack memory without any application interaction. The defect fires automatically on receipt of an unsolicited %NOTIFYEV: event whose payload exceeds 39 bytes and lacks a quote character within the linearized region, causing scanning loop indices to walk past the fixed 40-byte stack buffer. While the write primitive is weakly controlled — limiting demonstrated impact to denial of service and stack disclosure — the CVE is tagged RCE by reporters, though the description explicitly states memory-safe code execution has not been demonstrated. No public exploit or CISA KEV listing exists at time of analysis.

Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.

Out-of-bounds read in Zephyr RTOS's 6LoWPAN IPHC uncompression layer allows any unauthenticated attacker on the same IEEE 802.15.4 radio link to crash the receiving device by transmitting a single malformed frame. The flaw resides in get_ihpc_inlined_size() (subsys/net/ip/6lo.c), where a 4-bit index derived directly from the received IPHC dispatch word can reach values 13-15, all beyond the 13-entry da_inline_size_table, producing an out-of-bounds read that corrupts the computed inline size and subsequently underflows a size_t difference. No public exploit or CISA KEV listing exists at time of analysis; the fix is confirmed upstream.

Interrupt-storm livelock in Zephyr RTOS's ARM PL011 UART driver (versions 1.14.0 through 4.4.1) allows an attacker controlling the serial peer to permanently hang the CPU by injecting line errors that trigger an error interrupt the ISR never clears. The root cause is that pl011_isr() acknowledged only the CTS modem-status interrupt and never wrote the UARTICR register for error bits (framing, parity, break, overrun), leaving the interrupt line permanently asserted and causing the CPU to re-enter the ISR indefinitely. Exploitation is gated by a non-default configuration requirement - the error interrupt path is off by default and no in-tree Zephyr subsystem enables it - so only embedded applications explicitly calling uart_irq_err_enable() on a PL011 interrupt-driven port are at risk. No public exploit or CISA KEV listing exists at time of analysis.

Infinite loop denial of service in the Zephyr RTOS Bluetooth GATT client allows an unauthenticated adjacent attacker to permanently hang the Bluetooth host processing thread by sending a crafted ATT Read By Type Response with a zero-length stride value during standard descriptor discovery. Affected targets - which span all Zephyr versions per the wildcard CPE - face a hung BT subsystem and likely a watchdog reset on constrained embedded hardware, rendering Bluetooth functionality inoperative. No public exploit code or CISA KEV listing exists at time of analysis, but the upstream commit diff publicly discloses the exact offending code path, substantially lowering the barrier to exploit development.

Out-of-bounds write in Zephyr RTOS's llext subsystem allows a local attacker with low privileges to corrupt supervisor-context memory by loading a crafted relocatable ELF extension on Xtensa targets. The vulnerability in llext_link_plt() (subsys/llext/llext_link.c) occurs before any extension code executes - at link time - meaning sandbox protections are bypassed entirely. Exploitation complexity is high (CVSS AC:H) due to constraints on the write value, no public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to deployments using llext on Xtensa architecture.

Kernel heap corruption via a double-fetch race condition in Zephyr RTOS's unprivileged socket syscall verifiers allows a local low-privilege attacker to achieve kernel privilege escalation or trigger a kernel denial of service. The flaw exists in z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() within subsys/net/lib/sockets/sockets.c, where msg_iovlen is read twice from live user memory - once to size the kernel heap shadow buffer and once as the iovec copy-loop bound - enabling a cooperating attacker thread to inflate the field between those reads and drive an out-of-bounds write into adjacent kernel heap objects. No public exploit has been identified at time of analysis; an upstream patch commit is confirmed available via the Zephyr project security advisory.

Concurrent TLS handshakes on Zephyr RTOS devices built with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE cause a deterministic kernel panic and device reset via a NULL pointer dereference in the uninitialized credential mutex wait queue. The PSA Protected Storage credential backend in all affected Zephyr builds declared its serialization mutex without proper initialization, leaving its dlist sentinels as NULL; the fault triggers only on first contention but is fully deterministic once two threads race to acquire the lock. No public exploit has been identified and the issue is not in CISA KEV, though no exploit sophistication is required beyond opening multiple simultaneous TLS connections.

Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.

Out-of-bounds heap write in Zephyr RTOS's USB device-next CDC NCM class handler allows any physical USB host to corrupt the device's shared network buffer pool by issuing standard GET_NTB_PARAMETERS or GET_NTB_INPUT_SIZE control requests with a wLength field smaller than the response structure size. The overflow is bounded at up to 27 bytes and writes only fixed device constants, making its primary impact denial of service of the USB stack rather than arbitrary code execution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, exploitation requires only physical USB access to a device built with the opt-in device_next stack and CDC NCM class.

NULL pointer dereference in Zephyr RTOS's experimental device_next USB DFU class crashes any device where DFU download is enabled when a USB host sends a zero-length DFU_DNLOAD terminator after initiating a valid transfer. The result is a fatal CPU fault causing device crash or reset - impact is strictly limited to availability, with the vendor and commit diff explicitly confirming no memory corruption or information disclosure. No public exploit has been identified at time of analysis, and exploitation requires physical control of the attached USB host.

Double-free (CWE-415) and use-after-free read (CWE-416) vulnerabilities in the Realtek BEE Bluetooth HCI driver within Zephyr RTOS expose affected devices to memory pool corruption and likely crashes when an adjacent Bluetooth peer drives heavy transmit activity toward resource-exhaustion error conditions. The bt_hci_bee_send() function in hci_bee.c violated the bt_hci_driver_api buffer-ownership contract by routing all error exits through a shared cleanup label that unconditionally called net_buf_unref(), while the Zephyr host TX path also unrefs the buffer on error return - resulting in a double free of the same net_buf and a subsequent read of freed memory via a LOG_ERR call compiled in at the default error log level. An upstream fix is confirmed via Zephyr project commit 9a684b5c314fb1d8670b01f7b6c4450a9353906c; no formally released patched version has been independently confirmed, and no public exploit has been identified at the time of this analysis.

Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Uninitialized-memory and out-of-bounds read in the UpdateHub OTA client of Zephyr RTOS allows a malicious or on-path UpdateHub server to crash the device update thread via a crafted probe response, producing a network-triggerable denial of service. The flaw exists in z_impl_updatehub_probe() within subsys/mgmt/updatehub/updatehub.c, where metadata_copy is allocated with k_malloc (leaving heap unzeroed) and filled via memcpy without a NUL terminator; a subsequent strlen() then scans into uninitialized heap, producing an over-long length fed to json_obj_parse(). No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but it is remotely triggerable against Zephyr devices running UpdateHub without DTLS transport protection.

Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.

Out-of-bounds memory read and write in the Zephyr RTOS SF32LB MPI QSPI NOR flash driver allows a low-privileged thread, when explicitly granted flash device access in a CONFIG_USERSPACE build, to disclose arbitrary CPU-addressable memory or corrupt flash and invalidate cache beyond the mapped flash window. The root cause is a signed/unsigned type confusion in the offset bounds check: a crafted negative off_t value converts to a large unsigned integer and the subsequent addition wraps to a small result that passes the check, allowing memcpy to read from or program flash at attacker-controlled addresses. No public exploit code has been identified at time of analysis; exploitation is nonetheless mechanically straightforward for any attacker familiar with signed/unsigned integer confusion vulnerabilities.

Use-after-free in Zephyr RTOS kernel queue peek operations (z_impl_k_queue_peek_head and z_impl_k_queue_peek_tail in kernel/queue.c) allows a local low-privileged thread to obtain a dangling pointer to freed heap memory by winning a race against a concurrent k_queue_get call on a shared queue. Successful exploitation - requiring SMP or preemptive concurrency - can leak a stale heap pointer or crash the system when the returned dangling pointer is subsequently consumed as a live buffer in the net_buf, Bluetooth, USB, or networking subsystems. No public exploit exists and no active exploitation is confirmed; CVSS scores this at 3.6 (Low), accurately reflecting the narrow race window and local-only attack surface.

Use-after-free in Zephyr RTOS 4.4.0's Bluetooth ATT host layer (subsys/bluetooth/host/att.c) allows an adjacent unauthenticated peer to crash the Bluetooth host or potentially corrupt live memory by disconnecting while an ATT PDU is in-flight. The tx_meta_data_storage[] array retains a dangling att_chan pointer after L2CAP tears down and frees the channel slab slot, and the deferred att_tx_destroy_work_handler running on the system workqueue dereferences that freed pointer. No pairing or special privileges are required - a routine ATT connection is sufficient to reach the vulnerable code path. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Heap-based out-of-bounds write in the Zephyr RTOS hawkBit OTA update client (versions 2.4.0 through <4.5.0) allows a malicious or compromised hawkBit update server to corrupt device heap memory by sending a crafted HTTP response body. The off-by-one flaw in response_json_cb() allocates exactly the response body length with no room for the NUL terminator, writing one byte past the heap object and corrupting adjacent allocator metadata. No public exploit identified at time of analysis, but the SSVC framework rates this as automatable and the trigger is deterministic in Zephyr v4.0.0 and later for any response body exceeding 1100 bytes - a size normal for hawkBit deployment metadata.

Stack buffer over-read and stray one-byte NUL write in Zephyr RTOS's experimental OCPP 1.6 client allow a malicious or compromised OCPP central server - or an on-path attacker exploiting the commonly unencrypted ws:// transport - to crash a connected embedded device by sending a crafted WAMP RPC frame with an oversized uid or action field. The vulnerable helper extract_string_field() uses strncpy() without guaranteeing NUL-termination, causing a subsequent strchr() call to scan unbounded into adjacent stack memory; a secondary defect in extract_payload() compounds this on maximal-length frames. No active exploitation has been confirmed by CISA KEV, but SSVC classification indicates publicly available proof-of-concept code, and EPSS sits at a low 0.19% (10th percentile), consistent with a niche embedded RTOS attack surface.

PSA Crypto key slot exhaustion in Zephyr's Bluetooth Mesh subnet.c permanently leaks one key slot on every subnet key teardown when CONFIG_BT_MESH_PRIV_BEACONS is enabled (the default). Devices running Zephyr 3.6.0 through 4.4.x are affected: a provisioner or network administrator with the node's device key can trigger the leak via Config Server NetKey Delete, Key Refresh Procedure, or reprovisioning over the Bluetooth Mesh network. With the default pool of 16 PSA key slots, roughly a dozen such operations exhaust the pool, preventing subnet creation and potentially starving other on-device PSA consumers until a reboot. No public exploit or CISA KEV listing exists; real-world impact is constrained by the high-privilege and proximity requirements.

Out-of-bounds read in Zephyr RTOS DHCPv4 client (versions 1.7.0 through 4.4.x) allows an adjacent-network attacker to crash the DHCP client or leak adjacent pointer contents by sending a crafted DHCP reply with a message-type value greater than 8. The defect is a classic sizeof-vs-ARRAY_SIZE confusion: the bounds guard compares a raw msg_type byte against the byte-size of a pointer array (32 or 64, depending on architecture) rather than its element count of 8, so values 9-31/63 bypass the check and cause a wild-pointer dereference inside a debug log call. Exploitation is gated on a non-default build configuration (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), substantially reducing the real-world attack surface. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Bluetooth GATT notification and indication paths in Zephyr RTOS 2.6.0 through 4.4.x skip the application-configured encryption, authentication, and LESC security requirements for characteristic values when the application follows the documented idiom of passing the Characteristic Declaration attribute to the notify/indicate APIs. A remote Bluetooth peer within radio range can connect without pairing and trigger the server to emit protected characteristic values over an unsecured link by writing the Client Characteristic Configuration descriptor, achieving an access-control bypass and information disclosure. No public exploit is identified at time of analysis; exploitation requires adjacent network access and specific application configuration.

IPv6 packet forwarding in Zephyr RTOS versions 1.8.0 through 4.4.1 never decremented the hop limit on routed unicast packets, directly violating RFC 8200's mandatory loop-termination mechanism and enabling indefinite packet circulation in routing loops. Both forwarding branches of ipv6_route_packet() in subsys/net/ip - the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()) - were affected, with neither performing a hop-limit check nor decrement before calling net_send_data(). An on-path attacker who can induce or exploit a transient L3 routing loop converts it into a permanent forwarding storm, exhausting CPU and link bandwidth on the Zephyr forwarder and adjacent segments; no public exploit or active exploitation has been identified, and SSVC rates exploitation as none with a non-automatable attack.

Use-after-free in the Zephyr RTOS Bluetooth GATT client stack allows an adjacent Bluetooth peer acting as a GATT server to crash a Zephyr device or potentially redirect its execution by replying to a CCC-write with an ATT Error Response. The defect is a callback-ordering bug in gatt_write_ccc_rsp(): the API-documented termination signal notify(NULL) was emitted before subscribe(), so applications that free or recycle bt_gatt_subscribe_params in their termination handler dereference a dangling function pointer. No public exploit code or CISA KEV entry exists; a vendor patch commit is available but a specific tagged release version has not been confirmed.

Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.

Denial of service in Zephyr's Synopsys DesignWare I2C driver (slave mode) enables an I2C master on the same physical bus to cause permanent failure of the write_requested() callback due to a missing START_DET interrupt enable. This halts all subsequent write transactions and desynchronizes higher-layer framing until device reset. No public exploit identified; patch available from vendor.

Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.

Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.

Denial of service in Zephyr RTOS versions before 4.5.0 occurs when mounting a crafted ext2 filesystem with zero values in superblock fields s_blocks_per_group or s_inodes_per_group. An attacker with physical access via removable media can trigger a division-by-zero fault on ARM Cortex-M targets, causing a system crash. No other impact beyond availability; no active exploitation or public exploit is known.

Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.

Divide-by-zero in Zephyr's DesignWare SPI driver exposes kernel crash to locally-authorized userspace threads on all releases through v4.4.0. The spi_transceive syscall verify handler in spi_handlers.c copies the caller-supplied spi_config from userspace without validating the frequency field, allowing a thread with SPI device object access to pass frequency=0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(), which raises a CPU exception on Cortex-M Mainline and ARC platforms and halts the system. No public exploit has been identified at time of analysis; exploitation is gated behind a non-default build configuration and explicit privilege grant.

Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.

Kernel heap exhaustion in Zephyr RTOS affects all builds with CONFIG_USERSPACE enabled from v1.12.0 through v4.4.1, allowing any low-privilege user thread to permanently leak kernel memory by supplying a forged object handle to k_poll(). The z_vrfy_k_poll() syscall verifier allocates a kernel-side event copy but, prior to the fix, killed the calling thread via K_OOPS without freeing that buffer - a path any user thread can trigger repeatedly. By spawning additional threads that inherit the parent's resource_pool, an attacker can multiply the leak rate until the shared kernel heap is depleted, causing system-wide denial of service affecting queues, message buffers, and all future k_poll calls. No public exploit code or CISA KEV listing has been identified at time of analysis.

Zephyr RTOS Bluetooth Mesh PB-ADV provisioning can be permanently denied on any affected device within BLE advertising range by an unauthenticated remote attacker exploiting a timer-reset logic flaw in subsys/bluetooth/mesh/pb_adv.c. The watchdog timer governing protocol timeouts was rescheduled unconditionally before validity checks, allowing an attacker to hold a dead provisioning link open indefinitely by sending FCS-valid PDUs faster than the 60-120 second timeout interval. The device's unprovisioned beacon is suppressed and all new Link Open requests are rejected for as long as the attacker transmits, rendering the device permanently un-provisionable without a reboot. No public exploit is identified and the vulnerability is not listed in CISA KEV, though the attack requires no authentication and low complexity to execute from within BLE range.

Persistent denial of service in the NXP LPUART serial driver for Zephyr RTOS allows an unprivileged userspace thread to deterministically crash the entire embedded system by issuing a uart_configure() call with an unsupported parameter value while CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled. The driver's configure path calls LPUART_Deinit() before validating the requested configuration, gating the peripheral clock; if validation then rejects the parameters, the clock is never restored, and any subsequent LPUART register access - from any thread or interrupt handler - triggers a hard fault and system reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fault path is trivially and deterministically reproducible from userspace on affected NXP MCU targets.

Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.

Out-of-bounds read in the Zephyr RTOS LwM2M firmware-update pull client (lwm2m_pull_context.c) lets a malicious or compromised LwM2M management server - or an on-path attacker on a session without strong DTLS - leak adjacent device memory and crash devices by writing an over-long firmware Package URI (/5/0/1). Because the Firmware-Update object stores the URI in a 255-byte buffer but the pull context copies exactly 128 bytes into a fixed buffer with no NUL terminator, subsequent strlen-based parsing over-reads static memory that is then appended to outbound CoAP requests. It affects Zephyr 3.0.0 through 4.4.0 on the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path; there is no CISA KEV listing, EPSS is low (0.28%), and per the SSVC framework a proof-of-concept exists.

Kernel object corruption in Zephyr RTOS (v4.1.0 through v4.4.0) lets a deprivileged user thread on CONFIG_USERSPACE builds re-initialize a live k_pipe to which it has been granted access, orphaning threads already blocked on that pipe. Because z_impl_k_pipe_init() unconditionally resets the ring buffer and wait queues without accounting for pended waiters, a subsequent timeout or wake drives sys_dlist_remove() through dangling pointers, producing an attacker-influenced invalid kernel write, list corruption, lost wakeups, and silent data loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix hardens the k_pipe_init syscall verifier.

NULL pointer dereference in Zephyr RTOS's syscall verifier allows an unprivileged user-mode thread to crash the kernel across the userspace security boundary. The z_vrfy_k_thread_name_copy() verification handler in kernel/thread.c incorrectly guards against the caller-supplied thread pointer being NULL rather than the ko pointer returned by k_object_find(), so any non-NULL but unregistered address bypasses the check and triggers a supervisor-mode NULL dereference that halts or reboots the system. Affecting Zephyr v2.0.0 through v4.4.0 when built with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled, no public exploit code and no CISA KEV listing have been identified at time of analysis, but the one-syscall reproducibility makes this straightforward to trigger in qualifying builds.

Local privilege escalation and kernel memory corruption in Zephyr RTOS on Xtensa SoCs (v3.7.0 through v4.4.0) built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, where arch_buffer_validate() fails open on an integer-overflow edge case, letting an unprivileged user thread trick the kernel into reading or writing arbitrary kernel/partition memory on its behalf. The flaw stems from a default-permit return value combined with a ROUND_UP address-space wrap that skips the MPU probe loop entirely, and it is not caught by the existing syscall-layer overflow guards. Vendor patch is available; no public exploit identified at time of analysis, and this is not in CISA KEV.

Denial of service in Zephyr RTOS's Nuvoton NuMaker HSUSBD USB device-controller driver allows a physical or adjacent USB host to permanently wedge the device's USB control endpoint. The driver unconditionally arms the control Data IN stage without accounting for the hardware's inability to disarm an already-armed transfer, so a host that cancels an in-flight control transfer and then re-issues a SETUP packet drives the driver out of sync. Repeated cancel-and-re-SETUP cycles cause the control endpoint to NAK every subsequent transfer, rendering the USB function non-operational until a USB reset or re-plug. No public exploit identified at time of analysis.

Kernel memory corruption in the Zephyr RTOS (versions v1.14.0 through v4.4.0) lets an unprivileged user-mode thread corrupt the kernel's dynamic object-tracking list across the userspace security boundary. The flaw is a use-after-free race (CWE-416) in the obj_list traversal, exploitable only on builds combining CONFIG_SMP, CONFIG_USERSPACE, and CONFIG_DYNAMIC_OBJECTS, and can yield privilege escalation or a kernel crash. No public exploit identified at time of analysis; a vendor patch is available.

Stack out-of-bounds write in the Zephyr RTOS network IP-parsing utility (parse_ipv4() in subsys/net/ip/utils.c) lets a crafted "a.b.c.d:port" address string with an overlong post-colon suffix overflow a 17-byte stack buffer with fully attacker-controlled length and contents, affecting Zephyr 1.9.0 through 4.4.0. Any application that resolves a network-influenced address string via the standard socket API (zsock_getaddrinfo/literal resolution), DNS server-string configuration, or the eswifi Wi-Fi DNS-response path is exposed, yielding at minimum denial of service and potentially control-flow hijack. No public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records proof-of-concept maturity and EPSS is low at 0.35%.

Out-of-bounds write in the WireGuard subsystem of Zephyr RTOS 4.4.0 lets a malicious or compromised WireGuard peer (or an on-path attacker driving an established session) corrupt memory by sending an oversized transport-data datagram. Because the flawed copy occurs before the Poly1305 authentication check, exploitation needs only a valid receiver session index rather than a valid authenticator, and reliably yields at least a remote denial of service on the target device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Zephyr project has published advisory GHSA-3wqm-wgx2-9367 and an upstream fix.

Out-of-bounds stack write in Zephyr's nRF70 Wi-Fi driver exposes embedded systems to memory corruption when the nRF70 co-processor returns a power-save event with more than eight TWT flow entries. The vulnerable function `nrf_wifi_event_proc_get_power_save_info()` blindly copies co-processor-supplied TWT entries into a fixed 8-element stack array without validating `num_twt_flows` against `WIFI_MAX_TWT_FLOWS`, enabling heap/stack corruption of approximately 40 bytes per excess entry. No public exploit code exists and the flaw is not listed in CISA KEV, but the adjacent-network attack vector and the indirect over-the-air influence path via a rogue AP manipulating TWT sessions make this a meaningful risk in Wi-Fi 6 (802.11ax) deployment environments running Zephyr with `CONFIG_NRF70_STA_MODE`.

Use-after-free and double-free in Zephyr RTOS's experimental USB host stack (CONFIG_USB_HOST_STACK, introduced in v4.4.0) allows an attacker with physical USB access to crash the target device or corrupt live kernel slab objects by bouncing a USB device connection to trigger a second removal event after the slab has already been freed. The flaw exists because usbh_device_disconnect() frees the root usb_device slab object without clearing the cached ctx->root pointer, and UHC controller drivers (uhc_max3421e, uhc_mcux_common) emit UHC_EVT_DEV_REMOVED directly from hardware line-state with no debounce or re-entry guard. No public exploit identified at time of analysis, and no CISA KEV listing; the physical-access prerequisite substantially constrains the realistic attacker population.

Kernel denial-of-service in Zephyr RTOS v4.4.0's Dhara flash translation layer driver crashes the system during FTL disk initialization when a flash error coincides with the journal-resume checkpoint scan. The driver's dhara_nand_read/erase/prog/copy callbacks unconditionally dereference the caller-supplied err pointer, but the upstream Dhara library legitimately passes NULL during its binary search in find_last_checkblock(), triggering a NULL write and kernel fault. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; exploitation is gated on specific flash media conditions (uncorrectable ECC, bad block, or induced fault) occurring on a checkpoint page at mount time, constraining real-world risk to physical or supply-chain threat models.

Out-of-bounds read in Zephyr RTOS's mDNS detection logic crashes devices resolving short-suffix hostnames when CONFIG_MDNS_RESOLVER is compiled in. The flaw in dns_resolve_name_internal() reads a fixed 7 bytes from a suffix pointer regardless of the actual string length, causing a 1-2 byte over-read past the NUL terminator for suffixes like .org, .com, .net, or .io. Under the specific runtime condition of a tightly-sized allocation adjacent to an unmapped boundary (guard page, MPU domain, or ASAN), the over-read faults and crashes the device; no public exploit has been identified at time of analysis and CVSS 3.7 with AC:H accurately reflects the narrow crash preconditions.

NULL pointer dereference in the Zephyr RTOS MAX32xxx USB device controller driver (udc_max32.c) crashes devices running Zephyr v4.4.0 when a physically connected USB host aborts an in-flight EP0 control transfer by sending a new SETUP packet - a completely legal USB protocol action. The race condition between interrupt-queued transfer-completion events and asynchronous FIFO draining by the driver thread causes net_buf_add(NULL, ...) when udc_buf_get() returns NULL on an empty FIFO, producing a near-NULL pointer dereference and device fault. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis; real-world risk is constrained by the physical access prerequisite and the specific MAX32xxx hardware dependency.

Use-after-free in Zephyr's asynchronous SNTP client (sntp_close_async, v4.2.0-v4.4.0) can be triggered remotely by any network peer or off-path attacker capable of dropping or delaying UDP NTP responses, exploiting a race between the system workqueue thread and the socket-service poll thread. The most probable outcome is a crash of the networking subsystem thread (denial of service); where the freed net_context pool slot is rapidly reallocated, memory corruption is possible. The vulnerability is on the normal SNTP timeout path, making it reliably and periodically triggerable when NET_CONFIG_SNTP_INIT_RESYNC is enabled. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Race condition in Zephyr RTOS Bluetooth Classic RFCOMM host stack (v4.4.0 and earlier) permanently wedges session state and exhausts the fixed bt_rfcomm_pool when a peer-transmitted DISC frame for dlci 0 collides with a simultaneous local-initiated teardown. The underlying L2CAP channel is never released and the session slot is never reclaimed, eventually denying RFCOMM service to the targeted peer across repeated occurrences. No public exploit identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) with AV:A/AC:H accurately reflects both the Bluetooth adjacency prerequisite and the high-complexity timing race required.

Non-atomic reference-count manipulation in the Zephyr RTOS net_buf library (lib/net_buf/buf.c) allows a double-free/use-after-free when a single buffer is shared and independently unref'd across concurrent contexts. Because buf->ref and the per-data-block ref_count were incremented/decremented with plain C operators despite the API being documented as self-synchronizing, two holders racing net_buf_unref() under SMP or single-core preemption can each conclude they hold the last reference, causing a double k_heap_free()/k_free() (heap-metadata corruption and UAF on heap-hardening poison) for heap/variable-data pools, or a double return to the pool free list for any pool type. All Zephyr releases through v4.4.0 are affected; no public exploit is identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).

Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets an adjacent attacker leak controller memory to the HCI host and potentially crash the device. A malicious CIS peer or a broadcaster the device is BIS-synced to sends a framed ISO PDU whose start-segment length field is 0-2, causing a uint8_t underflow (len-3 → 253-255) that copies up to ~255 bytes past the received PDU into an HCI ISO packet. Publicly available exploit code exists (SSVC: poc); it is not listed in CISA KEV, and EPSS is low at 0.17%, indicating no evidence of widespread active exploitation.

Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious, spoofed, or on-path DNS server - or any LAN node when mDNS/LLMNR is enabled - return crafted truncated TXT or SRV records that leak residual receive-pool memory to the application, and in some configurations crash the device. It affects Zephyr v4.3.0 and v4.4.0; the SSVC framework records a proof-of-concept, so publicly available exploit code exists, though EPSS is low (0.20%, 10th percentile) and there is no public evidence of active exploitation. The disclosed data is bounded (~64 bytes for TXT, ~6 for SRV) and read-only, but can expose stale contents of prior DNS packets.

Denial of service in Zephyr RTOS v4.4.0 allows an attacker with access to a serial, UART, or shell-console interface to crash an affected embedded device by exhausting the MCUmgr shared buffer pool and triggering a NULL pointer dereference. The defect in mcumgr_serial_process_frag() (CWE-476) was introduced during the MCUmgr rework and manifests in default builds where assertion checks are compiled out, making the write-through-NULL a hard fault rather than a caught assertion. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but exploitation is straightforward for any attacker with interface access.

Arbitrary file read in the Zephyr RTOS HTTP server (subsys/net/lib/http) lets an unauthenticated remote client retrieve any readable file on the mounted filesystem volume by abusing path-traversal sequences against a registered static-filesystem resource. Affecting Zephyr v4.0.0 through v4.4.0 with CONFIG_FILE_SYSTEM enabled and a static-FS resource registered, the flaw stems from the raw request path being concatenated to the web root without canonicalization in both the HTTP/1 and HTTP/2 front-ends. No public exploit identified at time of analysis, but the bug is trivial to trigger (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and a vendor patch is available.

Forged IPv6 Neighbor Discovery acceptance in the Zephyr RTOS network stack (all releases through v4.4.0) lets an adjacent on-link attacker inject spoofed Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages because an operator-precedence bug in subsys/net/ip/ipv6_nbr.c silently skips every RFC 4861 sanity check whenever the (always-present) ICMPv6 code is 0. Because the bypassed checks include the Hop-Limit==255 on-link proof, even off-link/remote attackers may have forged ND packets accepted, enabling default-router/DNS/SLAAC hijacking and neighbor-cache poisoning for man-in-the-middle, redirection, and denial of service. A vendor patch exists (commit 095f064c) but there is no public exploit identified at time of analysis and the issue is not in CISA KEV.

USB CDC-NCM network driver in Zephyr RTOS through v4.4.0 permanently deadlocks the shared network egress thread when a USB bus suspend coincides with outbound device traffic, requiring a reboot to recover. The defect in `cdc_ncm_send()` ignores the return value of `usbd_ep_enqueue()` and unconditionally blocks on a completion semaphore that only the (never-fired) bulk-IN ISR can signal - halting not just CDC-NCM traffic but all egress on other interfaces sharing the TX thread. No public exploit code or active exploitation has been identified; the trigger is routine USB host power management, making this an availability risk for any embedded Zephyr device using USB virtual Ethernet.

NULL pointer dereference in the Zephyr Bluetooth LE Audio Basic Audio Profile unicast client crashes devices running Zephyr v4.3.0 and v4.4.0 (and earlier) when connected to a malicious or buggy remote ASCS server. The handler unicast_client_ep_qos_state() writes attacker-controlled QoS fields through stream->qos without verifying the pointer is non-NULL - a condition that legitimately exists during the window between bt_bap_stream_config() and unicast_group_add_stream(). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but CVSS adjacency (AV:A) and no-auth (PR:N) make it exploitable by any device within Bluetooth LE radio range acting as a rogue ASCS server.

Memory corruption and denial of service in Zephyr RTOS (v4.0.0 through v4.4.0) arises in the BSD-sockets getaddrinfo() implementation, where a timed-out DNS query is retried without cancelling the prior query, leaving a callback holding a pointer into a stack frame that goes out of scope after getaddrinfo() returns. A network-delivered DNS response matched by its spoofable 16-bit transaction id, or the resolver's own delayed timeout work, then writes through that stale pointer, enabling crashes or reused-stack corruption. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation is gated by a timing/race window reflected in CVSS AC:H.

Out-of-bounds write in Zephyr RTOS's Microchip SERCOM-G1 UART driver (introduced in v4.4.0) allows an adjacent attacker who can send serial data to corrupt one byte of memory immediately beyond the caller-supplied RX buffer, potentially causing a crash or denial of service. The flaw exists only when CONFIG_UART_MCHP_ASYNC is enabled (non-default on in-tree PIC32CM-JH board configs) and the consuming application calls uart_rx_enable() with a one-byte buffer - a narrow but real embedded firmware scenario. No exploit code is publicly available and this vulnerability is not listed in CISA KEV; the upstream fix has been committed but a tagged patched release version has not been independently confirmed.

Out-of-bounds heap write in the Zephyr RTOS IP socket stack (recvmsg/insert_pktinfo) lets an unprivileged local userspace thread corrupt kernel-heap memory on builds using CONFIG_USERSPACE. Affecting Zephyr v3.6.0 through v4.4.0, the flaw is triggered when an application calls recvmsg() with an undersized ancillary (msg_control) buffer on a UDP/IP socket that has IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled and a datagram arrives. There is no public exploit identified at time of analysis and EPSS is low (0.12%), but the memory-corruption primitive gives full C/I/A impact locally.

Remote denial of service in the Zephyr RTOS IPv6 network stack lets unauthenticated attackers permanently halt packet reception by sending a small number of crafted fragmented IPv6 packets. Each malicious fragment leaks its RX network buffer (CWE-772) instead of returning it to the memory slab, so a handful of packets exhausts the fixed RX buffer pool and the device stops receiving all traffic until reboot. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 7.5 (A:H only) reflects high availability impact with no confidentiality or integrity exposure.

Infinite-loop denial of service in the Zephyr RTOS PL011 UART driver (v4.1.0-v4.4.0) permanently stalls any thread that calls uart_irq_tx_enable() - including the Bluetooth HCI H4 send path - when CTS hardware flow control is enabled and the wired peer withholds CTS during transmission. The root cause is a software workaround loop (CWE-835) that compensates for the PL011 controller's level-transition TX interrupt behavior but never exits when pl011_fifo_fill() returns 0 due to a blocked CTS line. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; exploitation requires physical or hardware-adjacent control of the UART CTS pin, materially constraining real-world risk.

Denial-of-service and potential out-of-bounds read in the Zephyr RTOS Bluetooth Host ISO receive path allows a malicious or compromised Bluetooth controller to crash devices using CONFIG_BT_ISO_RX by sending malformed HCI ISO packets with undersized SDU headers. The flaw resides in bt_iso_recv() within subsys/bluetooth/host/iso.c, where header bytes are pulled without prior length validation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Denial of service in Zephyr RTOS Bluetooth Classic SDP parser allows adjacent Bluetooth attackers to crash devices via a malformed 3-byte SDP attribute that triggers a reachable kernel assertion. The flaw resides in bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c, where the parser pulls a value-type byte without first verifying buffer length, causing a kernel panic in assert-enabled builds and an out-of-bounds read with undefined behavior when assertions are disabled. No public exploit identified at time of analysis, though the GHSA advisory describes the trigger conditions in enough detail to reproduce.

Out-of-bounds read and denial-of-service in Zephyr RTOS's ext2 filesystem parser expose embedded devices to filesystem-level attacks via maliciously crafted disk images. The flaw resides in ext2_fetch_direntry() (subsys/fs/ext2/ext2_diskops.c), where insufficient validation of on-disk directory entry fields - specifically de_rec_len and de_name_len against block boundaries - allows a crafted ext2 image to trigger an oversized memcpy (out-of-bounds read) or a zero-progress infinite loop when de_rec_len equals zero. All Zephyr versions are indicated as affected per the wildcard CPE, no public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.

Out-of-bounds write in Zephyr RTOS Bluetooth Classic Hands-Free Profile (HFP) parser allows an adjacent Bluetooth peer acting as an Audio Gateway to corrupt heap/static memory on devices with CONFIG_BT_HFP_HF enabled. A single malformed +CIND response sent during Service Level Connection setup can crash the Bluetooth host or corrupt adjacent connection state with no user interaction. No public exploit identified at time of analysis, and the upstream fix is available via commit cf7693a in the zephyrproject-rtos repository.

Denial of service (and potential limited memory corruption) in the Zephyr RTOS IPv6 networking stack (versions 3.3.0 through 4.4.0) stems from a use-after-free in the IPv6 Neighbor Discovery send paths, where per-interface ICMP statistics are updated by reading from a network packet after the stack has already freed it. Any unauthenticated on-link node can trigger the Neighbor Advertisement path simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 and CONFIG_NET_STATISTICS_PER_INTERFACE enabled, causing a freed slab block to be dereferenced. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); a vendor patch is available, and impact is largely limited to crashes/DoS with only theoretical limited memory corruption.

Use-after-free in Zephyr RTOS's ICMPv4 echo handler allows any unauthenticated remote host to trigger memory corruption or a crash by sending a standard ICMP ping to an affected device. The defect exists in all versions from v1.14 (2019) through v4.4.0, where `icmpv4_handle_echo_request()` reads from a freed `net_pkt` struct after transferring packet ownership to the TX path - violating a contract explicitly documented in `net_core.c`. No public exploit code exists and this CVE does not appear in CISA KEV, but the zero-privilege, network-reachable attack surface makes it a meaningful risk for internet-exposed embedded and IoT deployments running Zephyr with ICMP statistics enabled.

Use-after-free in Zephyr RTOS's ICMPv6 stack (v4.2.0-v4.4.0) allows an unauthenticated remote attacker to crash the networking stack and potentially corrupt memory by sending a standard ICMPv6 Echo Request or any IPv6 packet that elicits an ICMPv6 error response. Both `icmpv6_handle_echo_request()` and `net_icmpv6_send_error()` call `net_pkt_iface()` on a packet after transferring it to `net_try_send_data()`, which may synchronously or asynchronously free the packet's memory slab before the statistics update executes. When `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the stale interface pointer is written through (`iface->stats.icmp.sent++`), escalating the read UAF into an attacker-influenced memory write; no public exploit has been identified at time of analysis, but the trigger is a universally available IPv6 primitive.