Zephyr
Monthly
Malformed 802.1Q Ethernet frames can panic or corrupt the network receive path in Zephyr RTOS builds that have CONFIG_NET_VLAN=y and a VLAN enabled on the receiving Ethernet interface. ethernet_recv() checks only that the first buffer holds a 14-byte plain Ethernet header, then reinterprets that same buffer as an 18-byte VLAN header when the ethertype is 0x8100, reading the TCI and inner ethertype from offsets 14-17 beyond the buffer's length and raising hdr_len to 18 so net_buf_pull() removes more bytes than exist. A single unauthenticated 14-17 byte broadcast frame with ethertype 0x8100 and TCI 0x0000 suffices, reachable by an adjacent/link-local attacker or a malicious USB host through the CDC ECM/NCM gadget classes; assertion-enabled builds panic (denial of service), while production builds with assertions and CONFIG_NET_BUF_HARDENING disabled suffer a uint16_t length underflow to 65534 that leaves later parsers reading far outside the fragment, giving out-of-bounds access with information-disclosure and corruption potential. No public exploit identified at time of analysis; exploitation is gated by the non-default VLAN configuration and hardware VLAN tag stripping absent.
Use-after-free in the Zephyr RTOS Bluetooth LE host lets an adjacent, unauthenticated peer with an established L2CAP connection-oriented channel (CoC) on a dynamic PSM (0x0080-0x00FF) leave a pending work item pointing into channel memory that the application has already been told it may free. The attacker only needs to send a data K-frame immediately followed by an L2CAP Disconnect Request; because the Bluetooth RX workqueue outranks the system workqueue under cooperative scheduling, the deferred rx_work item cannot run before teardown, so the stack's released() callback fires while the system workqueue still holds a reference, producing memory corruption, information disclosure, or a corrupted workqueue pending list. The vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N) reflects adjacent-only access, no privileges, and a scheduling race that must be won, and realistic exploitability is further reduced by the requirement that the application free or re-accept the channel in released(). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; an upstream fix commit is available.
An out-of-bounds write of up to 127 bytes in the Zephyr RTOS NXP MCUX TRNG entropy driver (drivers/entropy/entropy_mcux_trng.c) allows a locally-present attacker to corrupt memory immediately following a caller-supplied buffer on affected NXP i.MX RT5xx/RT6xx SoCs. Because entropy_get_entropy() is a syscall whose verifier (K_SYSCALL_MEMORY_WRITE) checks only the requested length, an unprivileged user-mode thread that has merely been granted the entropy device can supply a length such as 1 and an arbitrary destination, causing the kernel to write 128 bytes where 1 was proven to be owned; on these Cortex-M33 parts there is no MMU, so the overflow can land in adjacent kernel state. The same defect is reachable from kernel mode via getentropy() or sys_rand8_get()/sys_rand16_get() where those resolve to the hardware generator. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but exploitation is local, deterministic in offset, and low complexity, which the assessed vector captures as AV:L/AC:L/PR:L with changed scope and high integrity impact.
An unauthenticated attacker on the same link can crash or partially leak memory from Zephyr IPv6 devices by sending a unicast packet to a neighbor entry that is still in the unresolved state: net_route_ipv6_packet() reads the link-layer address at index NET_NBR_LLADDR_UNKNOWN (0xff) and returns a pointer roughly 2.5 KB past the end of the neighbor link-layer address array. Because builds with CONFIG_ASSERT enabled fire the misplaced assertion and panic, the primary outcome is a repeatable remote denial of service (CVSS 7.1, AV:A/AC:L/PR:N/UI:N, A:H), while builds with assertions disabled instead copy up to 8 bytes of unrelated static RAM into the destination link-layer address of the outgoing frame, disclosing them to any listener (C:L). Exploitation requires no router or forwarding configuration: CONFIG_NET_IPV6_ROUTE is enabled by default whenever the IPv6 neighbor cache is, and the attacker only needs to first force a neighbor into the unresolved state (e.g. by eliciting traffic to a spoofed non-existent address, or by sending a Router Advertisement without a source link-layer address option) before sending the trigger packet. No public exploit code was identified at time of analysis.
Local privilege escalation and sandbox escape in Zephyr RTOS affects builds with CONFIG_USERSPACE enabled that include a fuel-gauge driver: the syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() size kernel-side variable-length arrays directly from an unvalidated caller-supplied len, letting any user-mode thread displace the supervisor stack and, where the caller holds fuel-gauge object permissions, write len * sizeof(union fuel_gauge_prop_val) bytes of attacker-controlled data into privileged memory. The outcome is an out-of-bounds write executing in supervisor mode with attacker-chosen length and content, leading to kernel code execution or a device crash; with the default CONFIG_PRIVILEGED_STACK_SIZE of 1024 bytes, a len of roughly 170 is sufficient to overrun the privileged stack, and a hardware stack guard does not contain it because the copy begins below the guard and walks upward. CVSS 3.1 rates this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the vector requires the attacker to already hold a low-privilege foothold - here, the ability to execute a user-mode thread on the device - and no public exploit code has been identified at time of analysis.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread, in builds that enable both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT, to pass a user-writable kernel object - most practically a thread stack from k_thread_stack_alloc() or a granted static K_THREAD_STACK - to the device_deinit() syscall and achieve supervisor-mode code execution. The flaw is a type-confusion issue in z_vrfy_device_deinit(): validation with K_OBJ_ANY skips the object type comparison, so z_impl_device_deinit() treats attacker-written bytes as a struct device and follows attacker-controlled state and ops.deinit pointers. The upstream fix is available via commit 1036694889ab33996db41b4141ddf66aa786d267, no public exploit code was identified at time of analysis, and impact is gated by the required build configuration; v4.2.x and v4.3.x defaulted the vulnerable option to y, while v4.4.x is exposed only if explicitly enabled.
Sandbox escape and kernel-level out-of-bounds write in the Zephyr RTOS userspace subsystem: an unprivileged user-mode thread that holds an assigned resource pool can pass a size near SIZE_MAX to the k_object_alloc_size() syscall (or the thread-stack branch via k_thread_stack_alloc()), causing an unsigned integer wrap-around in dynamic_object_create() so that a few-byte heap chunk is allocated while the object descriptor is registered under the caller's requested type. The subsequent init syscall (for example k_mutex_init(), k_sem_init(), or k_thread_create()) then writes a full kernel object over the truncated allocation, giving a supervisor-mode heap overflow of attacker-influenced size and content that corrupts sys_heap chunk metadata and adjacent kernel objects, and - when CONFIG_GEN_PRIV_STACKS is set - plants an attacker-influenced wild pointer as a user thread's privileged stack base. This is a local, high-priority privilege-escalation issue (CVSS 8.8, AV:L/PR:L/S:C) rather than a remotely reachable one: exploitation requires code execution as an unprivileged thread inside the CONFIG_USERSPACE sandbox on a build that also enables CONFIG_DYNAMIC_OBJECTS (or CONFIG_DYNAMIC_THREAD under userspace) and that assigns a resource pool to the calling thread; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. The vendor has published a fix that rejects both overflowing computations and frees the partially built descriptor.
Zephyr RTOS running on ARM64 with CONFIG_USERSPACE can lose memory-domain isolation: after an application creates more than 255 memory domains over its lifetime, the bare round-robin ASID allocator in arch_mem_domain_init() wraps and hands the same non-global ASID to two live domains, allowing a user-mode thread in one domain to read and write memory belonging to another domain's partitions and thread stacks using that domain's permissions. Exploitation is constrained rather than trivial - k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only APIs with no syscall surface, so an unprivileged thread cannot drive the counter itself and the vulnerable application must itself create enough domains to wrap the allocator, and the ASID duplication must additionally coincide with a scheduling path that skips the TLB flush in z_arm64_swap_ptables() (for example the A->B->C three-domain sequence, or two aliased domains resident on separate CPUs under SMP). No public exploit code identified at time of analysis, and a vendor fix is available upstream, so this registers as moderate rather than urgent risk.
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attacker within Bluetooth radio range write attacker-chosen bytes into static .bss state by broadcasting a crafted Basic Audio Announcement (BASE) with more subgroups or a larger metadata LTV than the sink's fixed arrays can hold. No pairing, bonding, GATT connection, or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8); the target must be a build with CONFIG_BT_BAP_BROADCAST_SINK enabled and must be periodic-advertising-synced to the attacker's source, or to an advertiser whose address and SID the attacker impersonates (periodic advertising data is unauthenticated). Impact includes corruption of adjacent Bluetooth-audio state with potential remote code execution in the Bluetooth RX thread, plus out-of-bounds disclosure via the BAS receive-state notification; no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is a genuine high-priority flaw rather than a CVSS-inflated paper risk, and an upstream fix is available.
A stack-based buffer overflow in Zephyr's Bluetooth Mesh On-Demand Private Proxy solicitation handler lets any BLE device within radio range overwrite a target node's stack with attacker-controlled bytes by sending a non-connectable advertisement carrying an oversized mesh Proxy Solicitation. Exploitation requires no pairing, bonding, provisioning, or key material because the vulnerable copy happens before decryption, but it is limited to nodes built with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV that are currently eligible to be solicited (GATT Proxy disabled, On-Demand Private Proxy enabled) and physically within BLE range (CVSS 8.8, AV:A/PR:N/C:H/I:H/A:H, unauthenticated). Impact ranges from a reliable remote denial of service to plausible remote code execution; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor fix is available.
An integer underflow in Zephyr's IEEE 802.15.4 link-layer security receive path lets any attacker within radio range drive an out-of-bounds read and in-place write of up to roughly 240 bytes into the network buffer pool. When CONFIG_NET_L2_IEEE802154_SECURITY is enabled and a security session at a level other than IEEE802154_SECURITY_LEVEL_NONE is established, a single crafted data frame whose payload is shorter than the configured authentication tag makes payload_len wrap to as large as 255, so CCM decryption reads several hundred bytes past the end of the exactly-sized receive buffer - and this happens before the tag is ever verified, so no key material, association, authentication, or user interaction is needed (CVSS 8.1, AV:A/AC:L/PR:N/UI:N). The primary impact is memory corruption and denial of service rather than information disclosure, since the out-of-bounds bytes are not attacker-chosen and the frame is dropped when tag verification fails; no public exploit code was identified at time of analysis, and exposure is limited to builds that enable this non-default, experimental security feature.
Zephyr RTOS builds that enable CONFIG_USERSPACE and include an I3C controller driver allow an unprivileged user-mode thread with a grant on the I3C controller device object to escalate to supervisor privilege. The syscall verifier z_vrfy_i3c_do_ccc() checked the outer i3c_ccc_payload, the broadcast data buffer and the targets.payloads[] array but never validated the per-target data pointers carried inside each struct i3c_ccc_target_payload, and it validated the caller's live structure rather than a snapshot, so the driver dereferences an attacker-chosen kernel address; a read CCC turns this into an arbitrary-length out-of-bounds kernel write and a write CCC into a kernel memory disclosure (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-822). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is strictly local - there is no remote or network attack path. An upstream fix commit exists that snapshots the payload, copies the target array into kernel memory and validates every per-target buffer with K_SYSCALL_MEMORY(), but no tagged release version containing it was independently confirmed from the provided data.
Out-of-bounds kernel memory writes in the NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) of Zephyr RTOS let a local user-mode thread that has already been granted the ADC device object corrupt memory beyond an undersized buffer it supplies to the adc_read()/adc_read_async() syscalls. Exploitation of the privilege boundary requires a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC with the GAU ADC devicetree node enabled; the attack vector is localized (CVSS 3.1 8.4, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) and the caller must already hold a device-object grant, but the scope change (S:C) and high integrity/availability impact reflect a genuine userspace-to-kernel privilege escalation path capable of kernel memory corruption or a crash. No public exploit code and no confirmed active exploitation were identified at time of analysis; builds without CONFIG_USERSPACE or on SoCs other than RW61x with the GAU ADC node enabled are not exposed to the privilege boundary and only suffer a silent overflow when the application itself passes an undersized buffer.
An insufficient buffer-size validation defect in Zephyr RTOS's ADI MAX32 ADC driver (drivers/adc/adc_max32.c) allows a local, low-privileged user-mode thread to write up to twice the length of its supplied buffer into kernel memory, producing attacker-controlled out-of-bounds writes at an attacker-chosen offset. Exploitation requires a build compiled with CONFIG_USERSPACE running on ADI MAX32 hardware where the calling thread has already been granted access to a MAX32 ADC device object; on such a build the attacker fully controls channels, buffer, buffer_size and options->extra_samplings, and the resulting corruption of adjacent memory, kernel data or thread stacks is a plausible local privilege-escalation and denial-of-service primitive (CVSS 7.8, AV:L/PR:L). The flaw is not remotely exploitable, and builds without CONFIG_USERSPACE are reduced to a caller-side robustness defect since the application supplies its own buffer; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
An out-of-bounds kernel-mode write in Zephyr RTOS's NXP MCUX LPADC driver (drivers/adc/adc_mcux_lpadc.c) lets an unprivileged user-mode thread corrupt memory outside its own partition, providing a genuine local privilege-escalation and denial-of-service primitive rather than an inflated high-severity score. The bug affects builds compiled with CONFIG_USERSPACE that use the MCUX LPADC driver in interrupt-driven mode (or DMA-driven mode on releases carrying the DMA path), where adc_read()/adc_read_async() are system calls: a thread already granted access to the LPADC device object controls channels, buffer, buffer_size and options->extra_samplings, and can demand up to channels × 65536 samples into a tiny buffer, causing the driver's ISR or DMA callback to walk past the buffer while running in kernel mode where the MPU does not confine it. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the CVSS vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact from an authenticated local attacker, and upstream fixes are available.
Kernel memory corruption in Zephyr RTOS arises from the RTIO userspace syscall verifier z_vrfy_rtio_sqe_copy_in_get_handles(), which validates the RTIO object handle and the incoming sqes array but never checks that the caller-supplied handle out-parameter is writable before executing *handle = sqe in supervisor mode. Any user-mode thread that has been granted a struct rtio kernel object - the normal situation for applications using sensor_read_async_mempool() or the async ADC helpers, which call rtio_sqe_copy_in_get_handles() internally - can supply an arbitrary destination address and thereby obtain a write-what-where primitive that stores a pointer to attacker-controlled ring data at any kernel location, corrupting function pointers, thread structures or memory-domain partition tables and breaking the CONFIG_USERSPACE isolation boundary. The issue is local-only and build-gated (CVSS 7.8, AV:L/PR:L, CWE-787), requires both CONFIG_USERSPACE and CONFIG_RTIO, and no public exploit code has been identified at time of analysis, although an upstream vendor fix and GitHub security advisory are available.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread that holds access to the Intel time-aware GPIO (TGPIO) device object to perform two uncontrolled 8-byte supervisor-mode writes to attacker-chosen kernel addresses via the tgpio_pin_read_ts_ec() syscall. The syscall's verification handler omitted the K_SYSCALL_MEMORY_WRITE() check that the sibling handlers in the same file already perform, converting a benign timestamp read-back into a write-what-where primitive that can corrupt kernel data structures, escalate the calling thread to supervisor privilege, or crash the system. Exposed builds are narrow: CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y must both be set, and because the affected source file failed to compile from v3.6.0 until after it was repaired past v4.4.0, the realistically exposed population is v3.5.0 builds plus downstream trees that locally patched that build breakage; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though it is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Null pointer dereference in Zephyr RTOS's MQTT-SN client subsystem allows a malicious or on-path network actor to crash any Zephyr device running an active MQTT-SN session by suppressing gateway keepalive responses. The defect is a missing assignment from the SYS_SLIST_PEEK_HEAD_CONTAINER macro in process_ping(): gw is never populated, remains NULL, and is subsequently dereferenced and passed to the memory slab allocator. The outcome is a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE) or silent slab free-list corruption on targets where address 0 is writable. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the trivial trigger condition and absence of MQTT-SN authentication make this straightforward for any party controlling or impersonating the client's gateway.
Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.
Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.
Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.
Kernel heap corruption via a double-fetch race condition in Zephyr RTOS's unprivileged socket syscall verifiers allows a local low-privilege attacker to achieve kernel privilege escalation or trigger a kernel denial of service. The flaw exists in z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() within subsys/net/lib/sockets/sockets.c, where msg_iovlen is read twice from live user memory - once to size the kernel heap shadow buffer and once as the iovec copy-loop bound - enabling a cooperating attacker thread to inflate the field between those reads and drive an out-of-bounds write into adjacent kernel heap objects. No public exploit has been identified at time of analysis; an upstream patch commit is confirmed available via the Zephyr project security advisory.
Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Heap-based out-of-bounds write in the Zephyr RTOS hawkBit OTA update client (versions 2.4.0 through <4.5.0) allows a malicious or compromised hawkBit update server to corrupt device heap memory by sending a crafted HTTP response body. The off-by-one flaw in response_json_cb() allocates exactly the response body length with no room for the NUL terminator, writing one byte past the heap object and corrupting adjacent allocator metadata. No public exploit identified at time of analysis, but the SSVC framework rates this as automatable and the trigger is deterministic in Zephyr v4.0.0 and later for any response body exceeding 1100 bytes - a size normal for hawkBit deployment metadata.
Stack buffer over-read and stray one-byte NUL write in Zephyr RTOS's experimental OCPP 1.6 client allow a malicious or compromised OCPP central server - or an on-path attacker exploiting the commonly unencrypted ws:// transport - to crash a connected embedded device by sending a crafted WAMP RPC frame with an oversized uid or action field. The vulnerable helper extract_string_field() uses strncpy() without guaranteeing NUL-termination, causing a subsequent strchr() call to scan unbounded into adjacent stack memory; a secondary defect in extract_payload() compounds this on maximal-length frames. No active exploitation has been confirmed by CISA KEV, but SSVC classification indicates publicly available proof-of-concept code, and EPSS sits at a low 0.19% (10th percentile), consistent with a niche embedded RTOS attack surface.
IPv6 packet forwarding in Zephyr RTOS versions 1.8.0 through 4.4.1 never decremented the hop limit on routed unicast packets, directly violating RFC 8200's mandatory loop-termination mechanism and enabling indefinite packet circulation in routing loops. Both forwarding branches of ipv6_route_packet() in subsys/net/ip - the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()) - were affected, with neither performing a hop-limit check nor decrement before calling net_send_data(). An on-path attacker who can induce or exploit a transient L3 routing loop converts it into a permanent forwarding storm, exhausting CPU and link bandwidth on the Zephyr forwarder and adjacent segments; no public exploit or active exploitation has been identified, and SSVC rates exploitation as none with a non-automatable attack.
Use-after-free in the Zephyr RTOS Bluetooth GATT client stack allows an adjacent Bluetooth peer acting as a GATT server to crash a Zephyr device or potentially redirect its execution by replying to a CCC-write with an ATT Error Response. The defect is a callback-ordering bug in gatt_write_ccc_rsp(): the API-documented termination signal notify(NULL) was emitted before subscribe(), so applications that free or recycle bt_gatt_subscribe_params in their termination handler dereference a dangling function pointer. No public exploit code or CISA KEV entry exists; a vendor patch commit is available but a specific tagged release version has not been confirmed.
Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.
Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.
Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.
Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.
Out-of-bounds read in the Zephyr RTOS LwM2M firmware-update pull client (lwm2m_pull_context.c) lets a malicious or compromised LwM2M management server - or an on-path attacker on a session without strong DTLS - leak adjacent device memory and crash devices by writing an over-long firmware Package URI (/5/0/1). Because the Firmware-Update object stores the URI in a 255-byte buffer but the pull context copies exactly 128 bytes into a fixed buffer with no NUL terminator, subsequent strlen-based parsing over-reads static memory that is then appended to outbound CoAP requests. It affects Zephyr 3.0.0 through 4.4.0 on the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path; there is no CISA KEV listing, EPSS is low (0.28%), and per the SSVC framework a proof-of-concept exists.
Kernel object corruption in Zephyr RTOS (v4.1.0 through v4.4.0) lets a deprivileged user thread on CONFIG_USERSPACE builds re-initialize a live k_pipe to which it has been granted access, orphaning threads already blocked on that pipe. Because z_impl_k_pipe_init() unconditionally resets the ring buffer and wait queues without accounting for pended waiters, a subsequent timeout or wake drives sys_dlist_remove() through dangling pointers, producing an attacker-influenced invalid kernel write, list corruption, lost wakeups, and silent data loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix hardens the k_pipe_init syscall verifier.
Local privilege escalation and kernel memory corruption in Zephyr RTOS on Xtensa SoCs (v3.7.0 through v4.4.0) built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, where arch_buffer_validate() fails open on an integer-overflow edge case, letting an unprivileged user thread trick the kernel into reading or writing arbitrary kernel/partition memory on its behalf. The flaw stems from a default-permit return value combined with a ROUND_UP address-space wrap that skips the MPU probe loop entirely, and it is not caught by the existing syscall-layer overflow guards. Vendor patch is available; no public exploit identified at time of analysis, and this is not in CISA KEV.
Kernel memory corruption in the Zephyr RTOS (versions v1.14.0 through v4.4.0) lets an unprivileged user-mode thread corrupt the kernel's dynamic object-tracking list across the userspace security boundary. The flaw is a use-after-free race (CWE-416) in the obj_list traversal, exploitable only on builds combining CONFIG_SMP, CONFIG_USERSPACE, and CONFIG_DYNAMIC_OBJECTS, and can yield privilege escalation or a kernel crash. No public exploit identified at time of analysis; a vendor patch is available.
Stack out-of-bounds write in the Zephyr RTOS network IP-parsing utility (parse_ipv4() in subsys/net/ip/utils.c) lets a crafted "a.b.c.d:port" address string with an overlong post-colon suffix overflow a 17-byte stack buffer with fully attacker-controlled length and contents, affecting Zephyr 1.9.0 through 4.4.0. Any application that resolves a network-influenced address string via the standard socket API (zsock_getaddrinfo/literal resolution), DNS server-string configuration, or the eswifi Wi-Fi DNS-response path is exposed, yielding at minimum denial of service and potentially control-flow hijack. No public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records proof-of-concept maturity and EPSS is low at 0.35%.
Out-of-bounds write in the WireGuard subsystem of Zephyr RTOS 4.4.0 lets a malicious or compromised WireGuard peer (or an on-path attacker driving an established session) corrupt memory by sending an oversized transport-data datagram. Because the flawed copy occurs before the Poly1305 authentication check, exploitation needs only a valid receiver session index rather than a valid authenticator, and reliably yields at least a remote denial of service on the target device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Zephyr project has published advisory GHSA-3wqm-wgx2-9367 and an upstream fix.
Non-atomic reference-count manipulation in the Zephyr RTOS net_buf library (lib/net_buf/buf.c) allows a double-free/use-after-free when a single buffer is shared and independently unref'd across concurrent contexts. Because buf->ref and the per-data-block ref_count were incremented/decremented with plain C operators despite the API being documented as self-synchronizing, two holders racing net_buf_unref() under SMP or single-core preemption can each conclude they hold the last reference, causing a double k_heap_free()/k_free() (heap-metadata corruption and UAF on heap-hardening poison) for heap/variable-data pools, or a double return to the pool free list for any pool type. All Zephyr releases through v4.4.0 are affected; no public exploit is identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets an adjacent attacker leak controller memory to the HCI host and potentially crash the device. A malicious CIS peer or a broadcaster the device is BIS-synced to sends a framed ISO PDU whose start-segment length field is 0-2, causing a uint8_t underflow (len-3 → 253-255) that copies up to ~255 bytes past the received PDU into an HCI ISO packet. Publicly available exploit code exists (SSVC: poc); it is not listed in CISA KEV, and EPSS is low at 0.17%, indicating no evidence of widespread active exploitation.
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious, spoofed, or on-path DNS server - or any LAN node when mDNS/LLMNR is enabled - return crafted truncated TXT or SRV records that leak residual receive-pool memory to the application, and in some configurations crash the device. It affects Zephyr v4.3.0 and v4.4.0; the SSVC framework records a proof-of-concept, so publicly available exploit code exists, though EPSS is low (0.20%, 10th percentile) and there is no public evidence of active exploitation. The disclosed data is bounded (~64 bytes for TXT, ~6 for SRV) and read-only, but can expose stale contents of prior DNS packets.
Arbitrary file read in the Zephyr RTOS HTTP server (subsys/net/lib/http) lets an unauthenticated remote client retrieve any readable file on the mounted filesystem volume by abusing path-traversal sequences against a registered static-filesystem resource. Affecting Zephyr v4.0.0 through v4.4.0 with CONFIG_FILE_SYSTEM enabled and a static-FS resource registered, the flaw stems from the raw request path being concatenated to the web root without canonicalization in both the HTTP/1 and HTTP/2 front-ends. No public exploit identified at time of analysis, but the bug is trivial to trigger (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and a vendor patch is available.
Memory corruption and denial of service in Zephyr RTOS (v4.0.0 through v4.4.0) arises in the BSD-sockets getaddrinfo() implementation, where a timed-out DNS query is retried without cancelling the prior query, leaving a callback holding a pointer into a stack frame that goes out of scope after getaddrinfo() returns. A network-delivered DNS response matched by its spoofable 16-bit transaction id, or the resolver's own delayed timeout work, then writes through that stale pointer, enabling crashes or reused-stack corruption. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation is gated by a timing/race window reflected in CVSS AC:H.
Out-of-bounds heap write in the Zephyr RTOS IP socket stack (recvmsg/insert_pktinfo) lets an unprivileged local userspace thread corrupt kernel-heap memory on builds using CONFIG_USERSPACE. Affecting Zephyr v3.6.0 through v4.4.0, the flaw is triggered when an application calls recvmsg() with an undersized ancillary (msg_control) buffer on a UDP/IP socket that has IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled and a datagram arrives. There is no public exploit identified at time of analysis and EPSS is low (0.12%), but the memory-corruption primitive gives full C/I/A impact locally.
Remote denial of service in the Zephyr RTOS IPv6 network stack lets unauthenticated attackers permanently halt packet reception by sending a small number of crafted fragmented IPv6 packets. Each malicious fragment leaks its RX network buffer (CWE-772) instead of returning it to the memory slab, so a handful of packets exhausts the fixed RX buffer pool and the device stops receiving all traffic until reboot. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 7.5 (A:H only) reflects high availability impact with no confidentiality or integrity exposure.
Denial-of-service and potential out-of-bounds read in the Zephyr RTOS Bluetooth Host ISO receive path allows a malicious or compromised Bluetooth controller to crash devices using CONFIG_BT_ISO_RX by sending malformed HCI ISO packets with undersized SDU headers. The flaw resides in bt_iso_recv() within subsys/bluetooth/host/iso.c, where header bytes are pulled without prior length validation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Out-of-bounds write in Zephyr RTOS Bluetooth Classic Hands-Free Profile (HFP) parser allows an adjacent Bluetooth peer acting as an Audio Gateway to corrupt heap/static memory on devices with CONFIG_BT_HFP_HF enabled. A single malformed +CIND response sent during Service Level Connection setup can crash the Bluetooth host or corrupt adjacent connection state with no user interaction. No public exploit identified at time of analysis, and the upstream fix is available via commit cf7693a in the zephyrproject-rtos repository.
Denial of service (and potential limited memory corruption) in the Zephyr RTOS IPv6 networking stack (versions 3.3.0 through 4.4.0) stems from a use-after-free in the IPv6 Neighbor Discovery send paths, where per-interface ICMP statistics are updated by reading from a network packet after the stack has already freed it. Any unauthenticated on-link node can trigger the Neighbor Advertisement path simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 and CONFIG_NET_STATISTICS_PER_INTERFACE enabled, causing a freed slab block to be dereferenced. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); a vendor patch is available, and impact is largely limited to crashes/DoS with only theoretical limited memory corruption.
Use-after-free in Zephyr RTOS's ICMPv6 stack (v4.2.0-v4.4.0) allows an unauthenticated remote attacker to crash the networking stack and potentially corrupt memory by sending a standard ICMPv6 Echo Request or any IPv6 packet that elicits an ICMPv6 error response. Both `icmpv6_handle_echo_request()` and `net_icmpv6_send_error()` call `net_pkt_iface()` on a packet after transferring it to `net_try_send_data()`, which may synchronously or asynchronously free the packet's memory slab before the statistics update executes. When `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the stale interface pointer is written through (`iface->stats.icmp.sent++`), escalating the read UAF into an attacker-influenced memory write; no public exploit has been identified at time of analysis, but the trigger is a universally available IPv6 primitive.
Remotely triggerable denial of service in the Zephyr RTOS networking stack (versions 1.12.0 through 4.4.x) arises from a use-after-free in the IPv6 MLD code path, where mld_send() reads net_pkt_iface(pkt) after net_send_data() has already transferred packet ownership and the L2 driver freed it back to its memory slab. An unauthenticated attacker on the local link can elicit the vulnerable path by sending a crafted MLDv2 General Query, causing a NULL-pointer dereference crash or, in a narrow race, memory corruption via a stray statistics increment. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.
Out-of-bounds heap write in the Zephyr RTOS Bluetooth host allows a remote, unauthenticated BLE peer within radio range to corrupt memory during L2CAP LE Connection-oriented Channel (CoC) SDU reassembly. The flaw affects builds where the application enables SDU segmentation via chan_ops.alloc_buf and selects an RX net_buf pool whose user_data_size is smaller than 2 bytes, causing the reassembly segmentation counter in l2cap_chan_le_recv_seg() to be written past the allocated user_data region. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.01%), so realistic impact is a triggered fatal error / heap corruption rather than demonstrated code execution.
Remote code execution and denial of service in Zephyr RTOS HTTP server (versions 3.7.0 through 4.3.0) allow unauthenticated network attackers to corrupt stack memory by sending a crafted Sec-WebSocket-Key header during WebSocket upgrade. The flaw is a CWE-170 improper NUL-termination issue where a bounded copy fails to terminate the header buffer, causing strlen() and subsequent concatenation to read and write past stack bounds. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivially reachable attack surface make this a high-priority issue for any Zephyr deployment with CONFIG_HTTP_SERVER_WEBSOCKET enabled.
Out-of-bounds write/read in Zephyr RTOS (versions ≤ 4.3) affects the TLS socket connect path when the TLS session cache is enabled, where tls_session_store() and tls_session_restore() memcpy a caller-supplied socket address into a fixed-size 24-byte stack buffer using an unvalidated, caller-controlled addrlen. Because struct net_sockaddr is opaque, an application can pass an oversized addrlen (e.g. 128 bytes), corrupting adjacent memory and causing a crash/denial of service, with potential for arbitrary code execution. Publicly available exploit code exists per the SSVC 'poc' status, but EPSS is very low (0.06%, 18th percentile) and it is not on CISA KEV.
Out-of-bounds read in the Zephyr RTOS SocketCAN implementation lets a local userspace application leak adjacent memory or crash the system by submitting a truncated CAN frame through the sendto syscall. The zcan_sendto_ctx() path guards the user-supplied buffer length only with a NET_ASSERT, which is compiled out of production builds, so socketcan_to_can_frame() then dereferences fields past the end of the buffer. All Zephyr versions up to and including 4.3 are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile).
Memory corruption in the Zephyr RTOS eswifi socket offload driver (CVE-2026-1679) allows local code that can call the socket send API to overflow the fixed `eswifi->buf` buffer with an oversized payload, overwriting adjacent kernel memory in the class of unchecked buffer copies (CWE-120). The 7.8 base score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact but a strictly local attack surface that requires existing low-privilege code execution, a build that compiles in the eswifi offload path, and active use of the Inventek es-WiFi stack - there is no direct remote reach. Publicly available exploit code exists, yet EPSS is only 0.03% (10th percentile) and CISA's SSVC decision framework rates the issue non-automatable with partial technical impact, so this is a genuine but constrained local privilege and stability risk rather than an internet-facing emergency.
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on any device built with CONFIG_DNS_RESOLVER enabled, because the function caches the buffer's remaining tailroom once and reuses that stale value while appending decompressed DNS labels, allowing the terminating null byte to land past the end of the buffer. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but reactive: the target must itself initiate a name lookup and the attacker must be positioned to answer it - by operating a hostile or man-in-the-middle resolver or spoofing responses - so an adversary who cannot influence the device's DNS traffic cannot trigger the fault. Publicly available exploit code exists per the Zephyr GHSA advisory, though the vulnerability is not confirmed actively exploited (no CISA KEV listing) and the EPSS score is low at 0.05% (17th percentile). Our independent assessment agrees on the network/unauthenticated/High-integrity/High-availability profile but rates confidentiality impact Low rather than High.
An out-of-bounds read in the Zephyr RTOS STM32WBA IEEE 802.15.4 driver (drivers/ieee802154/ieee802154_stm32wba.c) lets an attacker within radio range of an STM32WBA-based device copy roughly 128 bytes of adjacent RAM into a network packet delivered to the networking stack. The flaw affects Zephyr 4.3.0 through 4.4.2 in the default production configuration (CONFIG_ASSERT=n), where the only length bound is compiled out; builds with CONFIG_ASSERT=y are not exploitable because the assertion would fire first. Impact is limited to a read-only information disclosure and oversized packet allocation in the RX thread - no code execution and no internet-reachable path - and no public exploit identified at time of analysis, with CVSS scored 4.2 (AV:A/AC:H/PR:N/UI:N).
Out-of-bounds write in the Zephyr CC1200 sub-GHz IEEE 802.15.4 driver lets an unauthenticated attacker within radio range transmit a frame whose first byte declares a PHY length above the IEEE 802.15.4 maximum of 127, driving an oversized net_buf allocation and a single SPI burst that can write up to 127 bytes past the end of the first 128-byte buffer fragment. The flaw affects builds that enable CONFIG_IEEE802154_CC1200 with a physically attached CC1200 radio in the driver's default variable-length mode (PKT_LEN = 0xFF), and exploitation is constrained by RF framing/timing requirements (CVSS 3.1 AV:A/AC:H/PR:N/UI:N, CWE-787), with the resulting overflow containing FIFO-underflow bytes so the realistic outcome is network-buffer-pool corruption and crashes rather than a controlled write. An upstream fix is available as a commit to verify_rxfifo_validity(), but no public exploit code or confirmed active exploitation was identified at time of analysis, and no independently confirmed tagged release containing the fix is documented here.
Integer underflow in the NXP KW41Z IEEE 802.15.4 receive path of Zephyr RTOS lets an attacker within radio range corrupt memory in the shared network-buffer pool from interrupt context. The driver samples the over-the-air PHY-header length byte from the ZLL IRQSTS register and subtracts the FCS length in a uint8_t, so a crafted frame advertising a length of one wraps to 255 bytes, which is copied into a single 128-byte net_buf fragment and overruns it by up to 127 bytes while also reading past the end of the radio's RX register array. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited; exploiting it requires RF proximity plus a timing race that the attacker must win by flooding length-one frames.
A use-after-free in Zephyr RTOS's Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) lets an adjacent Bluetooth peer crash or hang the entire device, producing a denial of service. The flaw is reachable only in builds where CONFIG_BT_HFP_AG is enabled (a profile Zephyr marks experimental and ships disabled by default) and where the application implements the optional asynchronous get_ongoing_call callback; a Hands-Free unit sends AT+CIND? during Service Level Connection setup, then tears down and re-opens the HFP RFCOMM DLC on the same ACL link within the ~10-second timeout window, deterministically reusing the same static pool slot while ag->ongoing_call_work is still armed and linked into the kernel timeout list. The repeated memset and k_work_init_delayable corrupt the kernel timeout dlist under an interrupts-locked announce loop, causing a fault or system hang; no attacker-controlled data is written, so code execution is not demonstrated. No public exploit code or in-the-wild exploitation was identified at time of analysis, and the exposed population is sharply limited by the non-default experimental configuration and physical Bluetooth proximity.
Memory corruption in Zephyr's Bluetooth Classic A2DP/AVDTP host stack allows an adjacent, paired BR/EDR peer to crash or hang the entire device by forcing a delayable work item to survive a session teardown. The attacker opens the AVDTP signalling channel, lets the local application issue an AVDTP procedure (the standard A2DP flow calls bt_a2dp_discover(), arming the 6-second AVDTP_TIMEOUT), then tears the channel down without responding and re-opens it within the remaining window, so that a2dp_get_connection() memsets the session while its timeout node is still linked into the kernel's global timeout list. Preconditions are narrow - the victim must run the experimental CONFIG_BT_A2DP option with the default CONFIG_TIMEOUT_BACKEND_DLIST backend and accept an encrypted (paired) BR/EDR link, which is why the assessed severity is a bounded denial-of-service rather than a remote pre-auth compromise; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Memory corruption in the Zephyr RTOS Bluetooth host ATT transmit path can be triggered by a peer in Bluetooth radio range whenever an application issues an ATT Signed Write Command over an unencrypted link. In chan_send(), the BT_ATT_OP_SIGNED_WRITE_CMD branch unrefers a net_buf it does not own after bt_smp_sign() fails (no local CSRK exists for the peer - a state the remote peer controls by pairing without requesting the signing key, pairing with No Bonding, staying unpaired, or keeping the link unencrypted); the callers honor the opposite ownership contract, so the already-freed buffer is re-queued, dereferenced and freed a second time, corrupting the ATT TX FIFO, deferred-destroy and pool free lists, while a related retry path can append a second 12-octet signature into a pooled buffer sized for one. Exploitation requires the deprecated, non-default CONFIG_BT_SIGNING build option plus a victim application that actually performs signed writes, giving CVSS 5.9 (AV:A/AC:H/PR:N, no confidentiality impact, high availability impact, low integrity impact); a vendor fix commit and GHSA-p3r4-qw98-j59m are available, and no public exploit was identified at time of analysis.
Zephyr RTOS Bluetooth Mesh nodes built with the default Access-layer delayed-message feature can be persistently muted by a mesh peer that is already provisioned into the same network and within Bluetooth radio range. By flooding the victim with requests that elicit segmented responses while withholding Segment Acknowledgments, the attacker forces bt_mesh_delayable_msg_manage() down an error path that returns a message context to neither the free nor the busy list, permanently shrinking the default four-entry context pool until every reply from Configuration Server, Health Server and application server models fails with -ENOMEM and is silently dropped. The impact is availability-only (CVSS 5.7, CWE-772, authenticated/PR:L and adjacent/AV:A per the assessed vector); the defect is cleared only by a reboot, the upstream fix is a committed source change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Availability loss in Zephyr RTOS Bluetooth Mesh affects nodes built with the default access-layer delayable message queue, where an unsynchronized race between the host RX thread and the system workqueue lets the handler touch a context slot that has already been purged. The attacker must be a provisioned mesh member - holding the NetKey and a bound AppKey - within Bluetooth radio range, who can control arrival rate, response size and destination address to exhaust the 4-entry context pool and 40-entry chunk pool and force the purge path; the trigger is a narrow, high-complexity race. Winning it produces a read-modify-write through a NULL-based pointer on the system workqueue thread, which on typical targets faults and aborts that thread (stopping all workqueue-driven functionality, including the mesh timing machinery) or resets the node, so impact is availability only - the write value and address are fixed, so there is no memory corruption or code execution path. Scoring is CVSS 3.1 4.8 (AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis, and there is no KEV listing.
The Bluetooth LE Controller in Zephyr RTOS can be faulted or have its receive PDU pool exhausted by a radio-range peer that drives the Link Layer PHY Update procedure into the retained-RX-node state and then sends an unexpected LL Control PDU before the update instant arrives; the invalid-PDU branches of llcp_lp_pu_rx() and llcp_rp_pu_rx() complete the procedure without releasing the retained node, so the procedure context is freed while the node stays out of the receive pool. In the default configuration (CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG both y) the violated invariant trips llcp_lr_check_done()/llcp_rr_check_done() and terminates in k_oops()/k_panic() from a single crafted PDU sequence, while on releases v3.4.0 through v3.7.x the assertion is never reached and each attempt silently leaks one PDU node from a pool that defaults to a single buffer (CONFIG_BT_CTLR_RX_BUFFERS=1), allowing a few reconnects to render Bluetooth inoperable until reboot. No pairing or encryption is required of the attacking peer (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit identified at time of analysis.
Denial of service affects Zephyr RTOS builds that include the Bluetooth Link Layer controller, where an over-the-air peer within Bluetooth radio range can trigger a retained RX node leak without pairing, bonding, or encryption. The peer sends a well-formed LL_CONNECTION_UPDATE_IND with a future instant (or reaches the same state as a central via LL_CONNECTION_PARAM_REQ, or through the local procedure via LL_REJECT_IND) and then, before that instant is reached, any other LL Control PDU such as LL_LENGTH_REQ; the invalid-PDU termination path completes the procedure without releasing the retained node, so llcp_rr_check_done() drops the last reference to it. With the default CONFIG_BT_CTLR_ASSERT_DEBUG enabled this produces an immediate fatal assertion in the controller, and with asserts disabled each occurrence permanently consumes a node from the small fixed RX pool until the receive path operates on NULL, with the impact being availability-only, limited to Bluetooth proximity, and persisting until reboot; no public exploit code was identified at time of analysis and there is no CISA KEV listing.
Zephyr's Bluetooth LE controller leaks a retained RX node when the Connected Isochronous Stream (CIS) Create control procedure is aborted through its "invalid PDU received" path, giving a radio-range attacker a denial-of-service primitive against affected devices. Any build with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is affected if it is mid-CIS-Create: against a peripheral the attacker sends a valid LL_CIS_REQ and then any unrelated LL Control PDU (for example LL_VERSION_IND) before the Host replies, while against a central a malicious peripheral simply answers LL_CIS_REQ with LL_UNKNOWN_RSP. In default builds the retained-node assertion fires immediately and produces a controller fatal error and usually a system reset from a single injected PDU; with CONFIG_BT_CTLR_ASSERT_DEBUG disabled, repeated connect-attack-reconnect cycles permanently drain the small LL notification pool until allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults, with recovery requiring a reboot. Only availability is impacted - the leaked node is orphaned and never reused or double-freed - and no public exploit identified at time of analysis. Exploitation requires the attacker to be within Bluetooth LE radio range of an unauthenticated, unencrypted ACL link; no pairing, encryption, or user interaction is needed.
System-wide denial of service can be triggered on Zephyr RTOS v4.4.0 or later builds for RISC-V Espressif SoCs (in-tree, the ESP32-C6 HPCORE) when CONFIG_USERSPACE is enabled: a local user-mode thread that has been granted the I2S device (PR:L) can issue a single i2s_trigger() call naming a direction the devicetree does not describe, causing a NULL pointer dereference in kernel mode (CWE-476). The impact is availability only-a NULL read with no attacker-controlled offset, no write primitive, and no information disclosure-but the default fatal-error handler halts the system, so an enabled user-mode thread can effect a system-wide denial of service. No public exploit code identified at time of analysis, and this is not confirmed actively exploited; real-world exposure is narrow because Xtensa Espressif targets do not support Zephyr userspace, ESP32-C5 does not select CONFIG_RISCV_PMP by default, and non-userspace builds can only pass the bad direction from trusted in-kernel code.
An out-of-bounds memory read in the Zephyr RTOS zbus proxy agent IPC backend allows a peer domain that already controls its own firmware - typically a second core on the same SoC - to leak a small amount of adjacent memory into the receiving domain's log output. The flaw is a non-NUL-terminated channel_name[] array being printed with a plain %s conversion on the frame-rejection error path; it is only reachable when CONFIG_ZBUS_PROXY_AGENT_IPC is built and logging is at warning level or higher (the default). Impact is bounded to limited information disclosure (CVSS 3.4, AV:L/PR:H, C:L/A:L) and a possible fatal fault if the scan leaves a mapped region; there is no public exploit identified at time of analysis and no confirmed active exploitation.
Predictable TCP initial sequence numbers in Zephyr RTOS allow off-path attackers to defeat RFC 6528 spoofing protection and perform blind TCP connection spoofing, data injection, or connection resets, but only on devices where the cryptographic random source fails exactly when the ISN secret key is first generated at boot. The flaw is a discarded return value from sys_csrand_get() that latches the 'key already generated' guard even on failure, leaving a 128-bit secret as all zeros for the entire boot; exploitation additionally requires the attacker to observe at least one ISN off-path and the spoofed peer to trust source addresses, and no public exploit was identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8), reflecting an unauthenticated remote issue whose high attack complexity and conditional preconditions keep it moderate rather than critical, and the signals converge on a conditional, moderate-severity issue rather than a top priority.
An out-of-bounds stack write in the Zephyr RTOS Goodix GT9xx touch driver (drivers/input/input_gt911.c) lets a malicious or misbehaving I2C touch controller overwrite up to 112 bytes of the gt911_process() stack frame with attacker-chosen data running at kernel privilege, potentially hijacking control flow on the host microcontroller. Only systems built with the GT9xx driver are affected, and reaching the defect requires physical/local access to the I2C bus (AV:P) - there is no network, USB, or syscall path - most plausibly on boards where the panel is a pluggable display module or shield rather than a soldered part. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the fix is a small one-line clamp and the same overflow can occur non-adversarially with a GT9271-class panel or a single corrupted status byte.
Out-of-bounds read of up to roughly 64 KiB in Zephyr's ITE IT8xxx2 SHI host-command backend allows an attacker who drives the SPI host controller to disclose adjacent embedded-controller SRAM to the host, or to fault the controller by reading past the end of SRAM. The root cause is a race: the 8-byte host-command header is copied from the SPI Rx FIFO directly into the shared in_msg buffer before the protocol version and derived packet length are validated, so a second transaction carrying data_len = 0xFFFF can deposit its header into a buffer that verify_rx() has already accepted; if those bytes land before the host-command thread assigns args.input_buf_size = rx_header->data_len, a registered handler is handed a 65535-byte length over a 256-byte buffer. Exploitation requires local control of the inter-processor SHI bus (a compromised host OS driving chip select and clock, or physical access to the SPI lines) plus a timing race the host can retry indefinitely, and is unauthenticated per the CVSS vector (PR:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Local user-mode threads in Zephyr RTOS builds that enable CONFIG_USERSPACE and CONFIG_SMBUS can invoke the smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() syscalls with an arbitrary pointer, silently unregistering SMBALERT or Host Notify callbacks that supervisor-mode code registered and thereby disabling alert handling system-wide; the same pointer can also be probed for valid kernel addresses because the syscall returns 0 on a hit versus -ENOENT on a miss. Exploitation is authenticated and local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, 4.4), requiring a user-mode thread that has already been granted the SMBus device object, and is limited to configurations using the Intel PCH SMBus driver with CONFIG_SMBUS_INTEL_PCH_SMBALERT or CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or the STM32 SMBus driver with CONFIG_SMBUS_STM32_SMBALERT; builds with CONFIG_ASSERT=y additionally turn a bogus pointer into a supervisor-mode fault and fatal system error, leaking which addresses are mapped. There is no impact on builds without CONFIG_USERSPACE or without an SMBus driver supporting SMBALERT/Host Notify, and no public exploit identified at time of analysis.
An out-of-bounds read in Zephyr's MCUmgr SMP-over-console transport (subsys/mgmt/mcumgr/transport/src/serial_util.c) lets a single 7-byte, unauthenticated console line underflow a net_buf length field and hand the SMP layer a bogus ~65 KB payload window over a buffer whose data area defaults to 384 bytes. The flaw affects builds that enable CONFIG_MCUMGR_TRANSPORT_UART (smp_uart.c) or CONFIG_MCUMGR_TRANSPORT_SHELL (smp_shell.c), both of which select MCUMGR_TRANSPORT_SERIAL_HAS_SMP_OVER_CONSOLE; the test-only CONFIG_MCUMGR_TRANSPORT_DUMMY loopback carries the same pattern but has no external input path and is not exploitable. Because exploitation needs only write access to the management console - on many boards an exposed USB CDC-ACM port rather than a bare UART header - the practical impact is a faulted MCUmgr thread (denial of service) plus possible limited memory disclosure via the default-enabled os echo handler; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Denial of service in the Zephyr RTOS LwM2M client: the CoAP Block1 write handler can be driven into a NULL pointer dereference that crashes or resets the device. Affected are Zephyr builds using the LwM2M engine with block-wise transfer handling, particularly NoSec deployments where CONFIG_LWM2M_DTLS_SUPPORT is disabled (it has no default, so this is a common configuration); an unauthenticated remote peer that can reach the LwM2M UDP socket - an on-path or address-spoofing attacker, or a bootstrap/lower-trust server - first exhausts the static Block1 context pool (CONFIG_LWM2M_NUM_BLOCK1_CONTEXT, default 3) with three incomplete block-wise writes, then sends a fourth first-block write to hit the unguarded store. The assessed impact is availability only (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 5.9), and no public exploit code was identified at time of analysis; the multi-request pool-exhaustion sequence is the main factor keeping complexity high.
Repeated network-interface link-down events can crash or reset devices running Zephyr RTOS v4.3.0 that keep a listening TCP socket open, because the BSD-socket layer parks a pending errno value in the net_context user_data field while the TCP core simultaneously expects that field to hold a parent context pointer; a second interface-down event forwards the stale integer to zsock_accepted_cb(), which dereferences it as a pointer and writes through it, producing a wild-pointer access and a kernel fatal error (denial of service, not attacker-directed memory corruption). The flaw is reachable by unauthenticated adjacent attackers who can force the link down repeatedly (CVSS 3.1 AV:A/AC:L/PR:N/UI:N, 6.5, availability-only impact), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Zephyr v4.3.1 and v4.4.x carry a follow-up change that clears the accept callback after the error path, reducing the issue to a narrow handshake-versus-interface-down race plus an unconditional getsockopt(SO_ERROR) read-back of the kernel pointer stored in user_data, so those lines are far less practically exploitable than v4.3.0.
An out-of-bounds read in the Zephyr RTOS CoAP link-format helper match_path_uri() (subsys/net/lib/coap/coap_link_format.c) allows an unauthenticated remote attacker to drive the URI comparison loop one or more bytes past the end of a Uri-Query href= option value by sending a GET /.well-known/core?href=/<prefix> request whose value is a strict prefix of a longer registered resource path. Only devices running the Zephyr CoAP server subsystem with CONFIG_COAP_SERVER_WELL_KNOWN_CORE enabled (the default) and at least one resource declaring struct coap_core_metadata attributes reach the vulnerable code path. The over-read is bounded - in practice a single byte, limited by the compared path length - reads only uninitialized stack tail rather than receive-buffer or attacker-controlled data, cannot influence the response, and yields undefined behaviour rather than information disclosure or a matching error; no public exploit code was identified at time of analysis, and the assessed severity is Low (CVSS 3.7).
A supervisor-mode out-of-bounds write exists in the Zephyr RTOS 802.15.4 L2 transmit path: ieee802154_send() copies packet data into a fixed 125-byte frame buffer without validating the packet length on the unfragmented code path. On builds with CONFIG_NET_L2_IEEE802154_FRAGMENT (enabled by default with CONFIG_NET_6LO), local code that opens a NET_AF_PACKET socket (NET_SOCK_RAW, which skips the 6LoWPAN encoder, or NET_SOCK_DGRAM, which returns early on the address-family check) bound to an 802.15.4 interface can send a payload larger than IEEE802154_MTU and corrupt memory adjacent to the transmit buffer pool, causing a crash or further compromise of kernel state. The flaw is not reachable from the radio because ieee802154_6lo_encode_pkt() length-checks IPv6 packets and forces fragmentation; in a CONFIG_USERSPACE build an unprivileged thread can reach it through the zsock_socket()/zsock_sendto() syscalls, though the overrun is bounded to roughly ll_hdr_len + 3 bytes with the default fixed-size net_buf configuration. No public exploit code was identified at time of analysis and the vendor patch is available (commit 3d4c6177d2dbd77d12d9b14cd75a00cdbd826227).
Denial of service in the Zephyr ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) lets a Wi-Fi-adjacent, unauthenticated attacker fault the device or permanently stop Wi-Fi reception in Zephyr builds (assessed range 4.2.0 through 4.4.1) that run an ESP co-processor over SPI with CONFIG_NANOPB_ENABLE_MALLOC selected. The driver takes a 16-bit TLV data_length straight off the wire and passes it to pb_istream_from_buffer() without validating it against the frame length, so pb_decode() can read roughly 62 KB past a 3188-byte stack object (CWE-125); the underlying half-duplex SPI aliasing bug lets the attacker steer the parser onto misaligned protobuf continuation bytes by getting the first fragment of a fragmented control response dropped mid-transmit, and the AP scan list the attacker can grow is the most convenient lever. Impact is limited to availability (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.3) with no disclosure or code execution; the high attack complexity reflects the timing race, no public exploit code identified at time of analysis, and the vendor has published a fix.
Concurrent writes to the same Internal Trusted Storage (ITS) UID in Zephyr RTOS can be encrypted with a duplicate AEAD nonce, because the default nonce provider secure_storage_its_transform_aead_get_nonce() keeps its counter in unsynchronized function-local statics (no lock). Affected are builds using the PSA ITS secure-storage transform with AES-GCM or ChaCha20-Poly1305, an application that writes the same UID from two threads at once, and one of the shipped log-structured back-ends (zms.c or the settings/NVS store) whose deferred garbage collection leaves both racing ciphertexts resident in the raw partition. The impact is cryptographic rather than direct code execution: nonce reuse under the same derived key leaks the XOR of the two plaintexts (potentially PSA persistent keys stored in ITS) and, for GCM, exposes the authentication key, allowing forgery of stored entries - but only for an adversary with local read access to the raw backing flash, and only where the same UID is written concurrently. CVSS is 5.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N), no CISA KEV listing, and no public exploit identified at time of analysis; risk is heavily gated by the narrow race window and the per-UID key salting that makes cross-UID collisions harmless. An upstream fix commit that serializes the provider with a mutex is available.
An out-of-bounds write of up to 895 bytes into static (.bss) memory can be triggered in Zephyr RTOS's Intel SEDI IPM driver (drivers/ipm/ipm_sedi.c) when the peer processor sets a doorbell payload length larger than the 128-byte incoming_data_buf. The vulnerable path is reachable when an application has registered an IPM receive callback via ipm_register_callback(), the driver's normal mode of use, and requires a local, highly privileged attacker (CVSS PR:H) with host-side ISH driver-level or raw BAR access to the device's memory-mapped register window, plus a production image built without CONFIG_DEBUG so the HAL's DBG_CHECK length guard is compiled away. The result is kernel data-structure corruption and a crash primitive - the overflow clobbers the driver context's k_sem and k_mutex and adjacent static data - but the flaw is platform-specific and locally scoped, so it is a moderate, defense-in-depth-relevant issue rather than an urgent internet-facing emergency; no public exploit identified at time of analysis, and an upstream fix commit is available.
A double-free (CWE-415) in Zephyr's experimental USB host stack lets a malicious or malformed USB peripheral crash the device: the stack frees the per-device configuration-descriptor buffer udev->cfg_desc on three error paths in usbh_device_set_configuration() but never clears the pointer, so the guarded cleanup in usbh_device_free() frees the same chunk again. Only builds with CONFIG_USB_HOST_STACK enabled are exposed, and because that stack is experimental and off by default most Zephyr deployments are unaffected; exploitation requires physical access to plug in the attacker-controlled device and, on v4.1.0-v4.3.x, a device-initiated removal or duplicate-connect event after a failed enumeration. With the default CONFIG_SYS_HEAP_HARDENING_BASIC the double free is caught and triggers k_panic() - a deterministic denial of service - while builds using CONFIG_SYS_HEAP_HARDENING_NONE or older releases corrupt the free list of the small 1024-byte usb_device_heap instead. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published a fix (commit d46a8c1f) and a GitHub security advisory, making this a genuine but low-priority issue given the physical-access and build-configuration prerequisites.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
An out-of-bounds read in Zephyr RTOS's gPTP (IEEE 802.1AS) announce-qualification routine lets an unauthenticated attacker with layer-2 adjacency to a vulnerable device send a single crafted Announce frame that drives the stack about 2 KB past the end of the received network buffer, potentially faulting the networking RX thread and causing a denial of service. The flaw affects only builds that enable the opt-in, experimental CONFIG_NET_GPTP option used in TSN/AVB deployments (Zephyr 1.13.0 up to before 4.4.2 per EUVD); default configurations are not vulnerable, and because gPTP frames go to a non-routed link-local multicast address, internet or routed exploitation is not possible. The impact is bounded by the assessed CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and no public exploit has been identified at time of analysis.
An out-of-bounds read in the Zephyr RTOS gPTP (IEEE 802.1AS) Ethernet layer lets an attacker on the same link crash-free but silently expose memory contents: a truncated Ethernet frame with ethertype 0x88F7 and fewer than 34 bytes of payload is accepted by gptp_handle_msg(), which dereferences a gPTP header pointer that extends past the received data and then retains the short packet for later state-machine parsing. Affected are Zephyr releases from 1.13.0 up to (but not including) 4.4.2 built with CONFIG_NET_GPTP on an interface configured as a gPTP port; no authentication or user interaction is required (PR:N/UI:N), though exploitation is limited by the adjacent-only vector and the requirement for a link that can deliver sub-minimum frames (for example the native_sim TAP driver or a MAC that accepts undersized frames). The impact is read-only and low (CVSS 3.1 base 3.1, C:L/I:N/A:N): under the default fixed-size buffer allocator only stale recycled buffer contents within the 128-byte fragment are disclosed, while a genuine out-of-bounds read requires the experimental CONFIG_NET_BUF_VARIABLE_DATA_SIZE allocator. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; an upstream fix commit and vendor advisory are available.
Physically attached USB hosts can crash Zephyr RTOS builds that use the ITE it82xx2 USB device-controller driver, because the driver re-initializes an already-pending delayed work item during a disable-then-enable cycle, corrupting kernel timeout and workqueue linked lists and causing a kernel panic. Affected builds are those running Zephyr 3.7.0 through versions below 4.4.2 with the it82xx2 UDC driver enabled, typically on hardware that faces a removable USB host — kiosks, field instrumentation, or development boards. Exploitation requires a direct physical USB connection (CVSS AV:P, score 4.6), delivers denial of service only with no confidentiality or integrity impact, and is not currently listed as actively exploited or accompanied by published exploit code.
A use-after-free write in the Zephyr RTOS ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) affects Zephyr 4.0.0 through 4.4.1 and allows a malicious USB host to create a kernel heap-corruption primitive on the device side. When a multi-packet OUT transfer is received on a non-control endpoint, the driver re-arms the endpoint to keep filling the same net_buf while simultaneously handing that buffer to the upper USB device stack, which may free and recycle it while DMA continues; the completing packet is also submitted a second time, corrupting the event slist and causing a double net_buf_unref(). Exploitation is physical (USB attach) with no authentication or user interaction required, giving a reliable denial of service and plausible adjacent-pool memory corruption; no public exploit code or CISA KEV listing was identified for this CVE at time of analysis.
Malformed 802.1Q Ethernet frames can panic or corrupt the network receive path in Zephyr RTOS builds that have CONFIG_NET_VLAN=y and a VLAN enabled on the receiving Ethernet interface. ethernet_recv() checks only that the first buffer holds a 14-byte plain Ethernet header, then reinterprets that same buffer as an 18-byte VLAN header when the ethertype is 0x8100, reading the TCI and inner ethertype from offsets 14-17 beyond the buffer's length and raising hdr_len to 18 so net_buf_pull() removes more bytes than exist. A single unauthenticated 14-17 byte broadcast frame with ethertype 0x8100 and TCI 0x0000 suffices, reachable by an adjacent/link-local attacker or a malicious USB host through the CDC ECM/NCM gadget classes; assertion-enabled builds panic (denial of service), while production builds with assertions and CONFIG_NET_BUF_HARDENING disabled suffer a uint16_t length underflow to 65534 that leaves later parsers reading far outside the fragment, giving out-of-bounds access with information-disclosure and corruption potential. No public exploit identified at time of analysis; exploitation is gated by the non-default VLAN configuration and hardware VLAN tag stripping absent.
Use-after-free in the Zephyr RTOS Bluetooth LE host lets an adjacent, unauthenticated peer with an established L2CAP connection-oriented channel (CoC) on a dynamic PSM (0x0080-0x00FF) leave a pending work item pointing into channel memory that the application has already been told it may free. The attacker only needs to send a data K-frame immediately followed by an L2CAP Disconnect Request; because the Bluetooth RX workqueue outranks the system workqueue under cooperative scheduling, the deferred rx_work item cannot run before teardown, so the stack's released() callback fires while the system workqueue still holds a reference, producing memory corruption, information disclosure, or a corrupted workqueue pending list. The vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N) reflects adjacent-only access, no privileges, and a scheduling race that must be won, and realistic exploitability is further reduced by the requirement that the application free or re-accept the channel in released(). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV; an upstream fix commit is available.
An out-of-bounds write of up to 127 bytes in the Zephyr RTOS NXP MCUX TRNG entropy driver (drivers/entropy/entropy_mcux_trng.c) allows a locally-present attacker to corrupt memory immediately following a caller-supplied buffer on affected NXP i.MX RT5xx/RT6xx SoCs. Because entropy_get_entropy() is a syscall whose verifier (K_SYSCALL_MEMORY_WRITE) checks only the requested length, an unprivileged user-mode thread that has merely been granted the entropy device can supply a length such as 1 and an arbitrary destination, causing the kernel to write 128 bytes where 1 was proven to be owned; on these Cortex-M33 parts there is no MMU, so the overflow can land in adjacent kernel state. The same defect is reachable from kernel mode via getentropy() or sys_rand8_get()/sys_rand16_get() where those resolve to the hardware generator. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but exploitation is local, deterministic in offset, and low complexity, which the assessed vector captures as AV:L/AC:L/PR:L with changed scope and high integrity impact.
An unauthenticated attacker on the same link can crash or partially leak memory from Zephyr IPv6 devices by sending a unicast packet to a neighbor entry that is still in the unresolved state: net_route_ipv6_packet() reads the link-layer address at index NET_NBR_LLADDR_UNKNOWN (0xff) and returns a pointer roughly 2.5 KB past the end of the neighbor link-layer address array. Because builds with CONFIG_ASSERT enabled fire the misplaced assertion and panic, the primary outcome is a repeatable remote denial of service (CVSS 7.1, AV:A/AC:L/PR:N/UI:N, A:H), while builds with assertions disabled instead copy up to 8 bytes of unrelated static RAM into the destination link-layer address of the outgoing frame, disclosing them to any listener (C:L). Exploitation requires no router or forwarding configuration: CONFIG_NET_IPV6_ROUTE is enabled by default whenever the IPv6 neighbor cache is, and the attacker only needs to first force a neighbor into the unresolved state (e.g. by eliciting traffic to a spoofed non-existent address, or by sending a Router Advertisement without a source link-layer address option) before sending the trigger packet. No public exploit code was identified at time of analysis.
Local privilege escalation and sandbox escape in Zephyr RTOS affects builds with CONFIG_USERSPACE enabled that include a fuel-gauge driver: the syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() size kernel-side variable-length arrays directly from an unvalidated caller-supplied len, letting any user-mode thread displace the supervisor stack and, where the caller holds fuel-gauge object permissions, write len * sizeof(union fuel_gauge_prop_val) bytes of attacker-controlled data into privileged memory. The outcome is an out-of-bounds write executing in supervisor mode with attacker-chosen length and content, leading to kernel code execution or a device crash; with the default CONFIG_PRIVILEGED_STACK_SIZE of 1024 bytes, a len of roughly 170 is sufficient to overrun the privileged stack, and a hardware stack guard does not contain it because the copy begins below the guard and walks upward. CVSS 3.1 rates this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the vector requires the attacker to already hold a low-privilege foothold - here, the ability to execute a user-mode thread on the device - and no public exploit code has been identified at time of analysis.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread, in builds that enable both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT, to pass a user-writable kernel object - most practically a thread stack from k_thread_stack_alloc() or a granted static K_THREAD_STACK - to the device_deinit() syscall and achieve supervisor-mode code execution. The flaw is a type-confusion issue in z_vrfy_device_deinit(): validation with K_OBJ_ANY skips the object type comparison, so z_impl_device_deinit() treats attacker-written bytes as a struct device and follows attacker-controlled state and ops.deinit pointers. The upstream fix is available via commit 1036694889ab33996db41b4141ddf66aa786d267, no public exploit code was identified at time of analysis, and impact is gated by the required build configuration; v4.2.x and v4.3.x defaulted the vulnerable option to y, while v4.4.x is exposed only if explicitly enabled.
Sandbox escape and kernel-level out-of-bounds write in the Zephyr RTOS userspace subsystem: an unprivileged user-mode thread that holds an assigned resource pool can pass a size near SIZE_MAX to the k_object_alloc_size() syscall (or the thread-stack branch via k_thread_stack_alloc()), causing an unsigned integer wrap-around in dynamic_object_create() so that a few-byte heap chunk is allocated while the object descriptor is registered under the caller's requested type. The subsequent init syscall (for example k_mutex_init(), k_sem_init(), or k_thread_create()) then writes a full kernel object over the truncated allocation, giving a supervisor-mode heap overflow of attacker-influenced size and content that corrupts sys_heap chunk metadata and adjacent kernel objects, and - when CONFIG_GEN_PRIV_STACKS is set - plants an attacker-influenced wild pointer as a user thread's privileged stack base. This is a local, high-priority privilege-escalation issue (CVSS 8.8, AV:L/PR:L/S:C) rather than a remotely reachable one: exploitation requires code execution as an unprivileged thread inside the CONFIG_USERSPACE sandbox on a build that also enables CONFIG_DYNAMIC_OBJECTS (or CONFIG_DYNAMIC_THREAD under userspace) and that assigns a resource pool to the calling thread; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. The vendor has published a fix that rejects both overflowing computations and frees the partially built descriptor.
Zephyr RTOS running on ARM64 with CONFIG_USERSPACE can lose memory-domain isolation: after an application creates more than 255 memory domains over its lifetime, the bare round-robin ASID allocator in arch_mem_domain_init() wraps and hands the same non-global ASID to two live domains, allowing a user-mode thread in one domain to read and write memory belonging to another domain's partitions and thread stacks using that domain's permissions. Exploitation is constrained rather than trivial - k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only APIs with no syscall surface, so an unprivileged thread cannot drive the counter itself and the vulnerable application must itself create enough domains to wrap the allocator, and the ASID duplication must additionally coincide with a scheduling path that skips the TLB flush in z_arm64_swap_ptables() (for example the A->B->C three-domain sequence, or two aliased domains resident on separate CPUs under SMP). No public exploit code identified at time of analysis, and a vendor fix is available upstream, so this registers as moderate rather than urgent risk.
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attacker within Bluetooth radio range write attacker-chosen bytes into static .bss state by broadcasting a crafted Basic Audio Announcement (BASE) with more subgroups or a larger metadata LTV than the sink's fixed arrays can hold. No pairing, bonding, GATT connection, or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8); the target must be a build with CONFIG_BT_BAP_BROADCAST_SINK enabled and must be periodic-advertising-synced to the attacker's source, or to an advertiser whose address and SID the attacker impersonates (periodic advertising data is unauthenticated). Impact includes corruption of adjacent Bluetooth-audio state with potential remote code execution in the Bluetooth RX thread, plus out-of-bounds disclosure via the BAS receive-state notification; no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is a genuine high-priority flaw rather than a CVSS-inflated paper risk, and an upstream fix is available.
A stack-based buffer overflow in Zephyr's Bluetooth Mesh On-Demand Private Proxy solicitation handler lets any BLE device within radio range overwrite a target node's stack with attacker-controlled bytes by sending a non-connectable advertisement carrying an oversized mesh Proxy Solicitation. Exploitation requires no pairing, bonding, provisioning, or key material because the vulnerable copy happens before decryption, but it is limited to nodes built with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV that are currently eligible to be solicited (GATT Proxy disabled, On-Demand Private Proxy enabled) and physically within BLE range (CVSS 8.8, AV:A/PR:N/C:H/I:H/A:H, unauthenticated). Impact ranges from a reliable remote denial of service to plausible remote code execution; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor fix is available.
An integer underflow in Zephyr's IEEE 802.15.4 link-layer security receive path lets any attacker within radio range drive an out-of-bounds read and in-place write of up to roughly 240 bytes into the network buffer pool. When CONFIG_NET_L2_IEEE802154_SECURITY is enabled and a security session at a level other than IEEE802154_SECURITY_LEVEL_NONE is established, a single crafted data frame whose payload is shorter than the configured authentication tag makes payload_len wrap to as large as 255, so CCM decryption reads several hundred bytes past the end of the exactly-sized receive buffer - and this happens before the tag is ever verified, so no key material, association, authentication, or user interaction is needed (CVSS 8.1, AV:A/AC:L/PR:N/UI:N). The primary impact is memory corruption and denial of service rather than information disclosure, since the out-of-bounds bytes are not attacker-chosen and the frame is dropped when tag verification fails; no public exploit code was identified at time of analysis, and exposure is limited to builds that enable this non-default, experimental security feature.
Zephyr RTOS builds that enable CONFIG_USERSPACE and include an I3C controller driver allow an unprivileged user-mode thread with a grant on the I3C controller device object to escalate to supervisor privilege. The syscall verifier z_vrfy_i3c_do_ccc() checked the outer i3c_ccc_payload, the broadcast data buffer and the targets.payloads[] array but never validated the per-target data pointers carried inside each struct i3c_ccc_target_payload, and it validated the caller's live structure rather than a snapshot, so the driver dereferences an attacker-chosen kernel address; a read CCC turns this into an arbitrary-length out-of-bounds kernel write and a write CCC into a kernel memory disclosure (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-822). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is strictly local - there is no remote or network attack path. An upstream fix commit exists that snapshots the payload, copies the target array into kernel memory and validates every per-target buffer with K_SYSCALL_MEMORY(), but no tagged release version containing it was independently confirmed from the provided data.
Out-of-bounds kernel memory writes in the NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) of Zephyr RTOS let a local user-mode thread that has already been granted the ADC device object corrupt memory beyond an undersized buffer it supplies to the adc_read()/adc_read_async() syscalls. Exploitation of the privilege boundary requires a Zephyr build with CONFIG_USERSPACE=y running on an NXP RW61x SoC with the GAU ADC devicetree node enabled; the attack vector is localized (CVSS 3.1 8.4, AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) and the caller must already hold a device-object grant, but the scope change (S:C) and high integrity/availability impact reflect a genuine userspace-to-kernel privilege escalation path capable of kernel memory corruption or a crash. No public exploit code and no confirmed active exploitation were identified at time of analysis; builds without CONFIG_USERSPACE or on SoCs other than RW61x with the GAU ADC node enabled are not exposed to the privilege boundary and only suffer a silent overflow when the application itself passes an undersized buffer.
An insufficient buffer-size validation defect in Zephyr RTOS's ADI MAX32 ADC driver (drivers/adc/adc_max32.c) allows a local, low-privileged user-mode thread to write up to twice the length of its supplied buffer into kernel memory, producing attacker-controlled out-of-bounds writes at an attacker-chosen offset. Exploitation requires a build compiled with CONFIG_USERSPACE running on ADI MAX32 hardware where the calling thread has already been granted access to a MAX32 ADC device object; on such a build the attacker fully controls channels, buffer, buffer_size and options->extra_samplings, and the resulting corruption of adjacent memory, kernel data or thread stacks is a plausible local privilege-escalation and denial-of-service primitive (CVSS 7.8, AV:L/PR:L). The flaw is not remotely exploitable, and builds without CONFIG_USERSPACE are reduced to a caller-side robustness defect since the application supplies its own buffer; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
An out-of-bounds kernel-mode write in Zephyr RTOS's NXP MCUX LPADC driver (drivers/adc/adc_mcux_lpadc.c) lets an unprivileged user-mode thread corrupt memory outside its own partition, providing a genuine local privilege-escalation and denial-of-service primitive rather than an inflated high-severity score. The bug affects builds compiled with CONFIG_USERSPACE that use the MCUX LPADC driver in interrupt-driven mode (or DMA-driven mode on releases carrying the DMA path), where adc_read()/adc_read_async() are system calls: a thread already granted access to the LPADC device object controls channels, buffer, buffer_size and options->extra_samplings, and can demand up to channels × 65536 samples into a tiny buffer, causing the driver's ISR or DMA callback to walk past the buffer while running in kernel mode where the MPU does not confine it. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the CVSS vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact from an authenticated local attacker, and upstream fixes are available.
Kernel memory corruption in Zephyr RTOS arises from the RTIO userspace syscall verifier z_vrfy_rtio_sqe_copy_in_get_handles(), which validates the RTIO object handle and the incoming sqes array but never checks that the caller-supplied handle out-parameter is writable before executing *handle = sqe in supervisor mode. Any user-mode thread that has been granted a struct rtio kernel object - the normal situation for applications using sensor_read_async_mempool() or the async ADC helpers, which call rtio_sqe_copy_in_get_handles() internally - can supply an arbitrary destination address and thereby obtain a write-what-where primitive that stores a pointer to attacker-controlled ring data at any kernel location, corrupting function pointers, thread structures or memory-domain partition tables and breaking the CONFIG_USERSPACE isolation boundary. The issue is local-only and build-gated (CVSS 7.8, AV:L/PR:L, CWE-787), requires both CONFIG_USERSPACE and CONFIG_RTIO, and no public exploit code has been identified at time of analysis, although an upstream vendor fix and GitHub security advisory are available.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread that holds access to the Intel time-aware GPIO (TGPIO) device object to perform two uncontrolled 8-byte supervisor-mode writes to attacker-chosen kernel addresses via the tgpio_pin_read_ts_ec() syscall. The syscall's verification handler omitted the K_SYSCALL_MEMORY_WRITE() check that the sibling handlers in the same file already perform, converting a benign timestamp read-back into a write-what-where primitive that can corrupt kernel data structures, escalate the calling thread to supervisor privilege, or crash the system. Exposed builds are narrow: CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y must both be set, and because the affected source file failed to compile from v3.6.0 until after it was repaired past v4.4.0, the realistically exposed population is v3.5.0 builds plus downstream trees that locally patched that build breakage; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though it is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Null pointer dereference in Zephyr RTOS's MQTT-SN client subsystem allows a malicious or on-path network actor to crash any Zephyr device running an active MQTT-SN session by suppressing gateway keepalive responses. The defect is a missing assignment from the SYS_SLIST_PEEK_HEAD_CONTAINER macro in process_ping(): gw is never populated, remains NULL, and is subsequently dereferenced and passed to the memory slab allocator. The outcome is a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE) or silent slab free-list corruption on targets where address 0 is writable. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the trivial trigger condition and absence of MQTT-SN authentication make this straightforward for any party controlling or impersonating the client's gateway.
Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.
Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.
Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.
Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.
Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.
Kernel heap corruption via a double-fetch race condition in Zephyr RTOS's unprivileged socket syscall verifiers allows a local low-privilege attacker to achieve kernel privilege escalation or trigger a kernel denial of service. The flaw exists in z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() within subsys/net/lib/sockets/sockets.c, where msg_iovlen is read twice from live user memory - once to size the kernel heap shadow buffer and once as the iovec copy-loop bound - enabling a cooperating attacker thread to inflate the field between those reads and drive an out-of-bounds write into adjacent kernel heap objects. No public exploit has been identified at time of analysis; an upstream patch commit is confirmed available via the Zephyr project security advisory.
Kernel-heap buffer overflow in Zephyr RTOS's DTLS socket layer allows a low-privileged user thread to write up to 31 bytes past an attacker-controlled heap allocation in the kernel. The root cause is that tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c forwarded a caller-supplied optval buffer to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (32) bytes, while the syscall verifier in CONFIG_USERSPACE builds allocated exactly optlen bytes for the bounce buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Heap-based out-of-bounds write in the Zephyr RTOS hawkBit OTA update client (versions 2.4.0 through <4.5.0) allows a malicious or compromised hawkBit update server to corrupt device heap memory by sending a crafted HTTP response body. The off-by-one flaw in response_json_cb() allocates exactly the response body length with no room for the NUL terminator, writing one byte past the heap object and corrupting adjacent allocator metadata. No public exploit identified at time of analysis, but the SSVC framework rates this as automatable and the trigger is deterministic in Zephyr v4.0.0 and later for any response body exceeding 1100 bytes - a size normal for hawkBit deployment metadata.
Stack buffer over-read and stray one-byte NUL write in Zephyr RTOS's experimental OCPP 1.6 client allow a malicious or compromised OCPP central server - or an on-path attacker exploiting the commonly unencrypted ws:// transport - to crash a connected embedded device by sending a crafted WAMP RPC frame with an oversized uid or action field. The vulnerable helper extract_string_field() uses strncpy() without guaranteeing NUL-termination, causing a subsequent strchr() call to scan unbounded into adjacent stack memory; a secondary defect in extract_payload() compounds this on maximal-length frames. No active exploitation has been confirmed by CISA KEV, but SSVC classification indicates publicly available proof-of-concept code, and EPSS sits at a low 0.19% (10th percentile), consistent with a niche embedded RTOS attack surface.
IPv6 packet forwarding in Zephyr RTOS versions 1.8.0 through 4.4.1 never decremented the hop limit on routed unicast packets, directly violating RFC 8200's mandatory loop-termination mechanism and enabling indefinite packet circulation in routing loops. Both forwarding branches of ipv6_route_packet() in subsys/net/ip - the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()) - were affected, with neither performing a hop-limit check nor decrement before calling net_send_data(). An on-path attacker who can induce or exploit a transient L3 routing loop converts it into a permanent forwarding storm, exhausting CPU and link bandwidth on the Zephyr forwarder and adjacent segments; no public exploit or active exploitation has been identified, and SSVC rates exploitation as none with a non-automatable attack.
Use-after-free in the Zephyr RTOS Bluetooth GATT client stack allows an adjacent Bluetooth peer acting as a GATT server to crash a Zephyr device or potentially redirect its execution by replying to a CCC-write with an ATT Error Response. The defect is a callback-ordering bug in gatt_write_ccc_rsp(): the API-documented termination signal notify(NULL) was emitted before subscribe(), so applications that free or recycle bt_gatt_subscribe_params in their termination handler dereference a dangling function pointer. No public exploit code or CISA KEV entry exists; a vendor patch commit is available but a specific tagged release version has not been confirmed.
Kernel privilege escalation in Zephyr RTOS v3.3.0-v4.4.1 is enabled by a signed/unsigned integer comparison error in the userspace syscall verifier for log_filter_set. An unprivileged user thread can supply a negative src_id value that bypasses the userspace bounds check, propagates into supervisor-mode kernel code, and - after implicit widening to uint32_t - indexes far out of bounds into kernel memory adjacent to the log_dynamic linker section, producing a constrained but attacker-directed read-modify-write primitive exploitable for privilege escalation. No public exploit has been identified at time of analysis; the fix, which replaces the flawed signed comparison with an unsigned one, is available in commit 56a15114.
Userspace ACL isolation is defeated in Zephyr RTOS v2.0.0 through v4.4.0 on SMP builds due to a missing spinlock in thread_idx_alloc(), allowing two concurrently executing user-mode threads to receive the same permission-index (tidx) and subsequently alias each other's ACL bit across every kernel object. Any kernel object access grant intended exclusively for one thread is silently extended to the aliasing thread, nullifying the CONFIG_USERSPACE isolation model. No public exploit or active exploitation (CISA KEV) is known at time of analysis, and SSVC marks automatable: no, but the technical impact is assessed as total, warranting prioritized patching for affected SMP deployments.
Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.
Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.
Out-of-bounds write in the Zephyr RTOS ADIN2111/ADIN1110 Ethernet driver (versions 3.7.0-4.4.x) allows an adjacent-network attacker to corrupt up to ~14.8 KB of kernel memory by sending crafted Ethernet frames over a 10BASE-T1S or 10BASE-T1L single-pair segment. The driver's OPEN Alliance SPI frame-reassembly function copies attacker-controlled 64-byte chunks into a fixed 1524-byte static buffer without validating the write cursor against the buffer boundary, enabling writes into adjacent driver and kernel memory. SSVC indicates a proof-of-concept exists; however, EPSS is low (0.23%, 14th percentile) and CISA KEV does not list active exploitation, suggesting the flaw is known but not yet widely weaponized.
Out-of-bounds read in the Zephyr RTOS LwM2M firmware-update pull client (lwm2m_pull_context.c) lets a malicious or compromised LwM2M management server - or an on-path attacker on a session without strong DTLS - leak adjacent device memory and crash devices by writing an over-long firmware Package URI (/5/0/1). Because the Firmware-Update object stores the URI in a 255-byte buffer but the pull context copies exactly 128 bytes into a fixed buffer with no NUL terminator, subsequent strlen-based parsing over-reads static memory that is then appended to outbound CoAP requests. It affects Zephyr 3.0.0 through 4.4.0 on the default-on CONFIG_LWM2M_FIRMWARE_UPDATE_PULL_SUPPORT path; there is no CISA KEV listing, EPSS is low (0.28%), and per the SSVC framework a proof-of-concept exists.
Kernel object corruption in Zephyr RTOS (v4.1.0 through v4.4.0) lets a deprivileged user thread on CONFIG_USERSPACE builds re-initialize a live k_pipe to which it has been granted access, orphaning threads already blocked on that pipe. Because z_impl_k_pipe_init() unconditionally resets the ring buffer and wait queues without accounting for pended waiters, a subsequent timeout or wake drives sys_dlist_remove() through dangling pointers, producing an attacker-influenced invalid kernel write, list corruption, lost wakeups, and silent data loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix hardens the k_pipe_init syscall verifier.
Local privilege escalation and kernel memory corruption in Zephyr RTOS on Xtensa SoCs (v3.7.0 through v4.4.0) built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, where arch_buffer_validate() fails open on an integer-overflow edge case, letting an unprivileged user thread trick the kernel into reading or writing arbitrary kernel/partition memory on its behalf. The flaw stems from a default-permit return value combined with a ROUND_UP address-space wrap that skips the MPU probe loop entirely, and it is not caught by the existing syscall-layer overflow guards. Vendor patch is available; no public exploit identified at time of analysis, and this is not in CISA KEV.
Kernel memory corruption in the Zephyr RTOS (versions v1.14.0 through v4.4.0) lets an unprivileged user-mode thread corrupt the kernel's dynamic object-tracking list across the userspace security boundary. The flaw is a use-after-free race (CWE-416) in the obj_list traversal, exploitable only on builds combining CONFIG_SMP, CONFIG_USERSPACE, and CONFIG_DYNAMIC_OBJECTS, and can yield privilege escalation or a kernel crash. No public exploit identified at time of analysis; a vendor patch is available.
Stack out-of-bounds write in the Zephyr RTOS network IP-parsing utility (parse_ipv4() in subsys/net/ip/utils.c) lets a crafted "a.b.c.d:port" address string with an overlong post-colon suffix overflow a 17-byte stack buffer with fully attacker-controlled length and contents, affecting Zephyr 1.9.0 through 4.4.0. Any application that resolves a network-influenced address string via the standard socket API (zsock_getaddrinfo/literal resolution), DNS server-string configuration, or the eswifi Wi-Fi DNS-response path is exposed, yielding at minimum denial of service and potentially control-flow hijack. No public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records proof-of-concept maturity and EPSS is low at 0.35%.
Out-of-bounds write in the WireGuard subsystem of Zephyr RTOS 4.4.0 lets a malicious or compromised WireGuard peer (or an on-path attacker driving an established session) corrupt memory by sending an oversized transport-data datagram. Because the flawed copy occurs before the Poly1305 authentication check, exploitation needs only a valid receiver session index rather than a valid authenticator, and reliably yields at least a remote denial of service on the target device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Zephyr project has published advisory GHSA-3wqm-wgx2-9367 and an upstream fix.
Non-atomic reference-count manipulation in the Zephyr RTOS net_buf library (lib/net_buf/buf.c) allows a double-free/use-after-free when a single buffer is shared and independently unref'd across concurrent contexts. Because buf->ref and the per-data-block ref_count were incremented/decremented with plain C operators despite the API being documented as self-synchronizing, two holders racing net_buf_unref() under SMP or single-core preemption can each conclude they hold the last reference, causing a double k_heap_free()/k_free() (heap-metadata corruption and UAF on heap-hardening poison) for heap/variable-data pools, or a double return to the pool free list for any pool type. All Zephyr releases through v4.4.0 are affected; no public exploit is identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets an adjacent attacker leak controller memory to the HCI host and potentially crash the device. A malicious CIS peer or a broadcaster the device is BIS-synced to sends a framed ISO PDU whose start-segment length field is 0-2, causing a uint8_t underflow (len-3 → 253-255) that copies up to ~255 bytes past the received PDU into an HCI ISO packet. Publicly available exploit code exists (SSVC: poc); it is not listed in CISA KEV, and EPSS is low at 0.17%, indicating no evidence of widespread active exploitation.
Out-of-bounds read in the Zephyr RTOS DNS resolver (subsys/net/lib/dns) lets a malicious, spoofed, or on-path DNS server - or any LAN node when mDNS/LLMNR is enabled - return crafted truncated TXT or SRV records that leak residual receive-pool memory to the application, and in some configurations crash the device. It affects Zephyr v4.3.0 and v4.4.0; the SSVC framework records a proof-of-concept, so publicly available exploit code exists, though EPSS is low (0.20%, 10th percentile) and there is no public evidence of active exploitation. The disclosed data is bounded (~64 bytes for TXT, ~6 for SRV) and read-only, but can expose stale contents of prior DNS packets.
Arbitrary file read in the Zephyr RTOS HTTP server (subsys/net/lib/http) lets an unauthenticated remote client retrieve any readable file on the mounted filesystem volume by abusing path-traversal sequences against a registered static-filesystem resource. Affecting Zephyr v4.0.0 through v4.4.0 with CONFIG_FILE_SYSTEM enabled and a static-FS resource registered, the flaw stems from the raw request path being concatenated to the web root without canonicalization in both the HTTP/1 and HTTP/2 front-ends. No public exploit identified at time of analysis, but the bug is trivial to trigger (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and a vendor patch is available.
Memory corruption and denial of service in Zephyr RTOS (v4.0.0 through v4.4.0) arises in the BSD-sockets getaddrinfo() implementation, where a timed-out DNS query is retried without cancelling the prior query, leaving a callback holding a pointer into a stack frame that goes out of scope after getaddrinfo() returns. A network-delivered DNS response matched by its spoofable 16-bit transaction id, or the resolver's own delayed timeout work, then writes through that stale pointer, enabling crashes or reused-stack corruption. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation is gated by a timing/race window reflected in CVSS AC:H.
Out-of-bounds heap write in the Zephyr RTOS IP socket stack (recvmsg/insert_pktinfo) lets an unprivileged local userspace thread corrupt kernel-heap memory on builds using CONFIG_USERSPACE. Affecting Zephyr v3.6.0 through v4.4.0, the flaw is triggered when an application calls recvmsg() with an undersized ancillary (msg_control) buffer on a UDP/IP socket that has IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled and a datagram arrives. There is no public exploit identified at time of analysis and EPSS is low (0.12%), but the memory-corruption primitive gives full C/I/A impact locally.
Remote denial of service in the Zephyr RTOS IPv6 network stack lets unauthenticated attackers permanently halt packet reception by sending a small number of crafted fragmented IPv6 packets. Each malicious fragment leaks its RX network buffer (CWE-772) instead of returning it to the memory slab, so a handful of packets exhausts the fixed RX buffer pool and the device stops receiving all traffic until reboot. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 7.5 (A:H only) reflects high availability impact with no confidentiality or integrity exposure.
Denial-of-service and potential out-of-bounds read in the Zephyr RTOS Bluetooth Host ISO receive path allows a malicious or compromised Bluetooth controller to crash devices using CONFIG_BT_ISO_RX by sending malformed HCI ISO packets with undersized SDU headers. The flaw resides in bt_iso_recv() within subsys/bluetooth/host/iso.c, where header bytes are pulled without prior length validation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Out-of-bounds write in Zephyr RTOS Bluetooth Classic Hands-Free Profile (HFP) parser allows an adjacent Bluetooth peer acting as an Audio Gateway to corrupt heap/static memory on devices with CONFIG_BT_HFP_HF enabled. A single malformed +CIND response sent during Service Level Connection setup can crash the Bluetooth host or corrupt adjacent connection state with no user interaction. No public exploit identified at time of analysis, and the upstream fix is available via commit cf7693a in the zephyrproject-rtos repository.
Denial of service (and potential limited memory corruption) in the Zephyr RTOS IPv6 networking stack (versions 3.3.0 through 4.4.0) stems from a use-after-free in the IPv6 Neighbor Discovery send paths, where per-interface ICMP statistics are updated by reading from a network packet after the stack has already freed it. Any unauthenticated on-link node can trigger the Neighbor Advertisement path simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 and CONFIG_NET_STATISTICS_PER_INTERFACE enabled, causing a freed slab block to be dereferenced. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile); a vendor patch is available, and impact is largely limited to crashes/DoS with only theoretical limited memory corruption.
Use-after-free in Zephyr RTOS's ICMPv6 stack (v4.2.0-v4.4.0) allows an unauthenticated remote attacker to crash the networking stack and potentially corrupt memory by sending a standard ICMPv6 Echo Request or any IPv6 packet that elicits an ICMPv6 error response. Both `icmpv6_handle_echo_request()` and `net_icmpv6_send_error()` call `net_pkt_iface()` on a packet after transferring it to `net_try_send_data()`, which may synchronously or asynchronously free the packet's memory slab before the statistics update executes. When `CONFIG_NET_STATISTICS_PER_INTERFACE` is enabled, the stale interface pointer is written through (`iface->stats.icmp.sent++`), escalating the read UAF into an attacker-influenced memory write; no public exploit has been identified at time of analysis, but the trigger is a universally available IPv6 primitive.
Remotely triggerable denial of service in the Zephyr RTOS networking stack (versions 1.12.0 through 4.4.x) arises from a use-after-free in the IPv6 MLD code path, where mld_send() reads net_pkt_iface(pkt) after net_send_data() has already transferred packet ownership and the L2 driver freed it back to its memory slab. An unauthenticated attacker on the local link can elicit the vulnerable path by sending a crafted MLDv2 General Query, causing a NULL-pointer dereference crash or, in a narrow race, memory corruption via a stray statistics increment. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not in CISA KEV; a vendor patch is available.
Out-of-bounds heap write in the Zephyr RTOS Bluetooth host allows a remote, unauthenticated BLE peer within radio range to corrupt memory during L2CAP LE Connection-oriented Channel (CoC) SDU reassembly. The flaw affects builds where the application enables SDU segmentation via chan_ops.alloc_buf and selects an RX net_buf pool whose user_data_size is smaller than 2 bytes, causing the reassembly segmentation counter in l2cap_chan_le_recv_seg() to be written past the allocated user_data region. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.01%), so realistic impact is a triggered fatal error / heap corruption rather than demonstrated code execution.
Remote code execution and denial of service in Zephyr RTOS HTTP server (versions 3.7.0 through 4.3.0) allow unauthenticated network attackers to corrupt stack memory by sending a crafted Sec-WebSocket-Key header during WebSocket upgrade. The flaw is a CWE-170 improper NUL-termination issue where a bounded copy fails to terminate the header buffer, causing strlen() and subsequent concatenation to read and write past stack bounds. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivially reachable attack surface make this a high-priority issue for any Zephyr deployment with CONFIG_HTTP_SERVER_WEBSOCKET enabled.
Out-of-bounds write/read in Zephyr RTOS (versions ≤ 4.3) affects the TLS socket connect path when the TLS session cache is enabled, where tls_session_store() and tls_session_restore() memcpy a caller-supplied socket address into a fixed-size 24-byte stack buffer using an unvalidated, caller-controlled addrlen. Because struct net_sockaddr is opaque, an application can pass an oversized addrlen (e.g. 128 bytes), corrupting adjacent memory and causing a crash/denial of service, with potential for arbitrary code execution. Publicly available exploit code exists per the SSVC 'poc' status, but EPSS is very low (0.06%, 18th percentile) and it is not on CISA KEV.
Out-of-bounds read in the Zephyr RTOS SocketCAN implementation lets a local userspace application leak adjacent memory or crash the system by submitting a truncated CAN frame through the sendto syscall. The zcan_sendto_ctx() path guards the user-supplied buffer length only with a NET_ASSERT, which is compiled out of production builds, so socketcan_to_can_frame() then dereferences fields past the end of the buffer. All Zephyr versions up to and including 4.3 are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile).
Memory corruption in the Zephyr RTOS eswifi socket offload driver (CVE-2026-1679) allows local code that can call the socket send API to overflow the fixed `eswifi->buf` buffer with an oversized payload, overwriting adjacent kernel memory in the class of unchecked buffer copies (CWE-120). The 7.8 base score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact but a strictly local attack surface that requires existing low-privilege code execution, a build that compiles in the eswifi offload path, and active use of the Inventek es-WiFi stack - there is no direct remote reach. Publicly available exploit code exists, yet EPSS is only 0.03% (10th percentile) and CISA's SSVC decision framework rates the issue non-automatable with partial technical impact, so this is a genuine but constrained local privilege and stability risk rather than an internet-facing emergency.
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on any device built with CONFIG_DNS_RESOLVER enabled, because the function caches the buffer's remaining tailroom once and reuses that stale value while appending decompressed DNS labels, allowing the terminating null byte to land past the end of the buffer. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but reactive: the target must itself initiate a name lookup and the attacker must be positioned to answer it - by operating a hostile or man-in-the-middle resolver or spoofing responses - so an adversary who cannot influence the device's DNS traffic cannot trigger the fault. Publicly available exploit code exists per the Zephyr GHSA advisory, though the vulnerability is not confirmed actively exploited (no CISA KEV listing) and the EPSS score is low at 0.05% (17th percentile). Our independent assessment agrees on the network/unauthenticated/High-integrity/High-availability profile but rates confidentiality impact Low rather than High.
An out-of-bounds read in the Zephyr RTOS STM32WBA IEEE 802.15.4 driver (drivers/ieee802154/ieee802154_stm32wba.c) lets an attacker within radio range of an STM32WBA-based device copy roughly 128 bytes of adjacent RAM into a network packet delivered to the networking stack. The flaw affects Zephyr 4.3.0 through 4.4.2 in the default production configuration (CONFIG_ASSERT=n), where the only length bound is compiled out; builds with CONFIG_ASSERT=y are not exploitable because the assertion would fire first. Impact is limited to a read-only information disclosure and oversized packet allocation in the RX thread - no code execution and no internet-reachable path - and no public exploit identified at time of analysis, with CVSS scored 4.2 (AV:A/AC:H/PR:N/UI:N).
Out-of-bounds write in the Zephyr CC1200 sub-GHz IEEE 802.15.4 driver lets an unauthenticated attacker within radio range transmit a frame whose first byte declares a PHY length above the IEEE 802.15.4 maximum of 127, driving an oversized net_buf allocation and a single SPI burst that can write up to 127 bytes past the end of the first 128-byte buffer fragment. The flaw affects builds that enable CONFIG_IEEE802154_CC1200 with a physically attached CC1200 radio in the driver's default variable-length mode (PKT_LEN = 0xFF), and exploitation is constrained by RF framing/timing requirements (CVSS 3.1 AV:A/AC:H/PR:N/UI:N, CWE-787), with the resulting overflow containing FIFO-underflow bytes so the realistic outcome is network-buffer-pool corruption and crashes rather than a controlled write. An upstream fix is available as a commit to verify_rxfifo_validity(), but no public exploit code or confirmed active exploitation was identified at time of analysis, and no independently confirmed tagged release containing the fix is documented here.
Integer underflow in the NXP KW41Z IEEE 802.15.4 receive path of Zephyr RTOS lets an attacker within radio range corrupt memory in the shared network-buffer pool from interrupt context. The driver samples the over-the-air PHY-header length byte from the ZLL IRQSTS register and subtracts the FCS length in a uint8_t, so a crafted frame advertising a length of one wraps to 255 bytes, which is copied into a single 128-byte net_buf fragment and overruns it by up to 127 bytes while also reading past the end of the radio's RX register array. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited; exploiting it requires RF proximity plus a timing race that the attacker must win by flooding length-one frames.
A use-after-free in Zephyr RTOS's Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) lets an adjacent Bluetooth peer crash or hang the entire device, producing a denial of service. The flaw is reachable only in builds where CONFIG_BT_HFP_AG is enabled (a profile Zephyr marks experimental and ships disabled by default) and where the application implements the optional asynchronous get_ongoing_call callback; a Hands-Free unit sends AT+CIND? during Service Level Connection setup, then tears down and re-opens the HFP RFCOMM DLC on the same ACL link within the ~10-second timeout window, deterministically reusing the same static pool slot while ag->ongoing_call_work is still armed and linked into the kernel timeout list. The repeated memset and k_work_init_delayable corrupt the kernel timeout dlist under an interrupts-locked announce loop, causing a fault or system hang; no attacker-controlled data is written, so code execution is not demonstrated. No public exploit code or in-the-wild exploitation was identified at time of analysis, and the exposed population is sharply limited by the non-default experimental configuration and physical Bluetooth proximity.
Memory corruption in Zephyr's Bluetooth Classic A2DP/AVDTP host stack allows an adjacent, paired BR/EDR peer to crash or hang the entire device by forcing a delayable work item to survive a session teardown. The attacker opens the AVDTP signalling channel, lets the local application issue an AVDTP procedure (the standard A2DP flow calls bt_a2dp_discover(), arming the 6-second AVDTP_TIMEOUT), then tears the channel down without responding and re-opens it within the remaining window, so that a2dp_get_connection() memsets the session while its timeout node is still linked into the kernel's global timeout list. Preconditions are narrow - the victim must run the experimental CONFIG_BT_A2DP option with the default CONFIG_TIMEOUT_BACKEND_DLIST backend and accept an encrypted (paired) BR/EDR link, which is why the assessed severity is a bounded denial-of-service rather than a remote pre-auth compromise; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Memory corruption in the Zephyr RTOS Bluetooth host ATT transmit path can be triggered by a peer in Bluetooth radio range whenever an application issues an ATT Signed Write Command over an unencrypted link. In chan_send(), the BT_ATT_OP_SIGNED_WRITE_CMD branch unrefers a net_buf it does not own after bt_smp_sign() fails (no local CSRK exists for the peer - a state the remote peer controls by pairing without requesting the signing key, pairing with No Bonding, staying unpaired, or keeping the link unencrypted); the callers honor the opposite ownership contract, so the already-freed buffer is re-queued, dereferenced and freed a second time, corrupting the ATT TX FIFO, deferred-destroy and pool free lists, while a related retry path can append a second 12-octet signature into a pooled buffer sized for one. Exploitation requires the deprecated, non-default CONFIG_BT_SIGNING build option plus a victim application that actually performs signed writes, giving CVSS 5.9 (AV:A/AC:H/PR:N, no confidentiality impact, high availability impact, low integrity impact); a vendor fix commit and GHSA-p3r4-qw98-j59m are available, and no public exploit was identified at time of analysis.
Zephyr RTOS Bluetooth Mesh nodes built with the default Access-layer delayed-message feature can be persistently muted by a mesh peer that is already provisioned into the same network and within Bluetooth radio range. By flooding the victim with requests that elicit segmented responses while withholding Segment Acknowledgments, the attacker forces bt_mesh_delayable_msg_manage() down an error path that returns a message context to neither the free nor the busy list, permanently shrinking the default four-entry context pool until every reply from Configuration Server, Health Server and application server models fails with -ENOMEM and is silently dropped. The impact is availability-only (CVSS 5.7, CWE-772, authenticated/PR:L and adjacent/AV:A per the assessed vector); the defect is cleared only by a reboot, the upstream fix is a committed source change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Availability loss in Zephyr RTOS Bluetooth Mesh affects nodes built with the default access-layer delayable message queue, where an unsynchronized race between the host RX thread and the system workqueue lets the handler touch a context slot that has already been purged. The attacker must be a provisioned mesh member - holding the NetKey and a bound AppKey - within Bluetooth radio range, who can control arrival rate, response size and destination address to exhaust the 4-entry context pool and 40-entry chunk pool and force the purge path; the trigger is a narrow, high-complexity race. Winning it produces a read-modify-write through a NULL-based pointer on the system workqueue thread, which on typical targets faults and aborts that thread (stopping all workqueue-driven functionality, including the mesh timing machinery) or resets the node, so impact is availability only - the write value and address are fixed, so there is no memory corruption or code execution path. Scoring is CVSS 3.1 4.8 (AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis, and there is no KEV listing.
The Bluetooth LE Controller in Zephyr RTOS can be faulted or have its receive PDU pool exhausted by a radio-range peer that drives the Link Layer PHY Update procedure into the retained-RX-node state and then sends an unexpected LL Control PDU before the update instant arrives; the invalid-PDU branches of llcp_lp_pu_rx() and llcp_rp_pu_rx() complete the procedure without releasing the retained node, so the procedure context is freed while the node stays out of the receive pool. In the default configuration (CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG both y) the violated invariant trips llcp_lr_check_done()/llcp_rr_check_done() and terminates in k_oops()/k_panic() from a single crafted PDU sequence, while on releases v3.4.0 through v3.7.x the assertion is never reached and each attempt silently leaks one PDU node from a pool that defaults to a single buffer (CONFIG_BT_CTLR_RX_BUFFERS=1), allowing a few reconnects to render Bluetooth inoperable until reboot. No pairing or encryption is required of the attacking peer (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit identified at time of analysis.
Denial of service affects Zephyr RTOS builds that include the Bluetooth Link Layer controller, where an over-the-air peer within Bluetooth radio range can trigger a retained RX node leak without pairing, bonding, or encryption. The peer sends a well-formed LL_CONNECTION_UPDATE_IND with a future instant (or reaches the same state as a central via LL_CONNECTION_PARAM_REQ, or through the local procedure via LL_REJECT_IND) and then, before that instant is reached, any other LL Control PDU such as LL_LENGTH_REQ; the invalid-PDU termination path completes the procedure without releasing the retained node, so llcp_rr_check_done() drops the last reference to it. With the default CONFIG_BT_CTLR_ASSERT_DEBUG enabled this produces an immediate fatal assertion in the controller, and with asserts disabled each occurrence permanently consumes a node from the small fixed RX pool until the receive path operates on NULL, with the impact being availability-only, limited to Bluetooth proximity, and persisting until reboot; no public exploit code was identified at time of analysis and there is no CISA KEV listing.
Zephyr's Bluetooth LE controller leaks a retained RX node when the Connected Isochronous Stream (CIS) Create control procedure is aborted through its "invalid PDU received" path, giving a radio-range attacker a denial-of-service primitive against affected devices. Any build with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is affected if it is mid-CIS-Create: against a peripheral the attacker sends a valid LL_CIS_REQ and then any unrelated LL Control PDU (for example LL_VERSION_IND) before the Host replies, while against a central a malicious peripheral simply answers LL_CIS_REQ with LL_UNKNOWN_RSP. In default builds the retained-node assertion fires immediately and produces a controller fatal error and usually a system reset from a single injected PDU; with CONFIG_BT_CTLR_ASSERT_DEBUG disabled, repeated connect-attack-reconnect cycles permanently drain the small LL notification pool until allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults, with recovery requiring a reboot. Only availability is impacted - the leaked node is orphaned and never reused or double-freed - and no public exploit identified at time of analysis. Exploitation requires the attacker to be within Bluetooth LE radio range of an unauthenticated, unencrypted ACL link; no pairing, encryption, or user interaction is needed.
System-wide denial of service can be triggered on Zephyr RTOS v4.4.0 or later builds for RISC-V Espressif SoCs (in-tree, the ESP32-C6 HPCORE) when CONFIG_USERSPACE is enabled: a local user-mode thread that has been granted the I2S device (PR:L) can issue a single i2s_trigger() call naming a direction the devicetree does not describe, causing a NULL pointer dereference in kernel mode (CWE-476). The impact is availability only-a NULL read with no attacker-controlled offset, no write primitive, and no information disclosure-but the default fatal-error handler halts the system, so an enabled user-mode thread can effect a system-wide denial of service. No public exploit code identified at time of analysis, and this is not confirmed actively exploited; real-world exposure is narrow because Xtensa Espressif targets do not support Zephyr userspace, ESP32-C5 does not select CONFIG_RISCV_PMP by default, and non-userspace builds can only pass the bad direction from trusted in-kernel code.
An out-of-bounds memory read in the Zephyr RTOS zbus proxy agent IPC backend allows a peer domain that already controls its own firmware - typically a second core on the same SoC - to leak a small amount of adjacent memory into the receiving domain's log output. The flaw is a non-NUL-terminated channel_name[] array being printed with a plain %s conversion on the frame-rejection error path; it is only reachable when CONFIG_ZBUS_PROXY_AGENT_IPC is built and logging is at warning level or higher (the default). Impact is bounded to limited information disclosure (CVSS 3.4, AV:L/PR:H, C:L/A:L) and a possible fatal fault if the scan leaves a mapped region; there is no public exploit identified at time of analysis and no confirmed active exploitation.
Predictable TCP initial sequence numbers in Zephyr RTOS allow off-path attackers to defeat RFC 6528 spoofing protection and perform blind TCP connection spoofing, data injection, or connection resets, but only on devices where the cryptographic random source fails exactly when the ISN secret key is first generated at boot. The flaw is a discarded return value from sys_csrand_get() that latches the 'key already generated' guard even on failure, leaving a 128-bit secret as all zeros for the entire boot; exploitation additionally requires the attacker to observe at least one ISN off-path and the spoofed peer to trust source addresses, and no public exploit was identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8), reflecting an unauthenticated remote issue whose high attack complexity and conditional preconditions keep it moderate rather than critical, and the signals converge on a conditional, moderate-severity issue rather than a top priority.
An out-of-bounds stack write in the Zephyr RTOS Goodix GT9xx touch driver (drivers/input/input_gt911.c) lets a malicious or misbehaving I2C touch controller overwrite up to 112 bytes of the gt911_process() stack frame with attacker-chosen data running at kernel privilege, potentially hijacking control flow on the host microcontroller. Only systems built with the GT9xx driver are affected, and reaching the defect requires physical/local access to the I2C bus (AV:P) - there is no network, USB, or syscall path - most plausibly on boards where the panel is a pluggable display module or shield rather than a soldered part. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the fix is a small one-line clamp and the same overflow can occur non-adversarially with a GT9271-class panel or a single corrupted status byte.
Out-of-bounds read of up to roughly 64 KiB in Zephyr's ITE IT8xxx2 SHI host-command backend allows an attacker who drives the SPI host controller to disclose adjacent embedded-controller SRAM to the host, or to fault the controller by reading past the end of SRAM. The root cause is a race: the 8-byte host-command header is copied from the SPI Rx FIFO directly into the shared in_msg buffer before the protocol version and derived packet length are validated, so a second transaction carrying data_len = 0xFFFF can deposit its header into a buffer that verify_rx() has already accepted; if those bytes land before the host-command thread assigns args.input_buf_size = rx_header->data_len, a registered handler is handed a 65535-byte length over a 256-byte buffer. Exploitation requires local control of the inter-processor SHI bus (a compromised host OS driving chip select and clock, or physical access to the SPI lines) plus a timing race the host can retry indefinitely, and is unauthenticated per the CVSS vector (PR:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Local user-mode threads in Zephyr RTOS builds that enable CONFIG_USERSPACE and CONFIG_SMBUS can invoke the smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() syscalls with an arbitrary pointer, silently unregistering SMBALERT or Host Notify callbacks that supervisor-mode code registered and thereby disabling alert handling system-wide; the same pointer can also be probed for valid kernel addresses because the syscall returns 0 on a hit versus -ENOENT on a miss. Exploitation is authenticated and local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, 4.4), requiring a user-mode thread that has already been granted the SMBus device object, and is limited to configurations using the Intel PCH SMBus driver with CONFIG_SMBUS_INTEL_PCH_SMBALERT or CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or the STM32 SMBus driver with CONFIG_SMBUS_STM32_SMBALERT; builds with CONFIG_ASSERT=y additionally turn a bogus pointer into a supervisor-mode fault and fatal system error, leaking which addresses are mapped. There is no impact on builds without CONFIG_USERSPACE or without an SMBus driver supporting SMBALERT/Host Notify, and no public exploit identified at time of analysis.
An out-of-bounds read in Zephyr's MCUmgr SMP-over-console transport (subsys/mgmt/mcumgr/transport/src/serial_util.c) lets a single 7-byte, unauthenticated console line underflow a net_buf length field and hand the SMP layer a bogus ~65 KB payload window over a buffer whose data area defaults to 384 bytes. The flaw affects builds that enable CONFIG_MCUMGR_TRANSPORT_UART (smp_uart.c) or CONFIG_MCUMGR_TRANSPORT_SHELL (smp_shell.c), both of which select MCUMGR_TRANSPORT_SERIAL_HAS_SMP_OVER_CONSOLE; the test-only CONFIG_MCUMGR_TRANSPORT_DUMMY loopback carries the same pattern but has no external input path and is not exploitable. Because exploitation needs only write access to the management console - on many boards an exposed USB CDC-ACM port rather than a bare UART header - the practical impact is a faulted MCUmgr thread (denial of service) plus possible limited memory disclosure via the default-enabled os echo handler; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Denial of service in the Zephyr RTOS LwM2M client: the CoAP Block1 write handler can be driven into a NULL pointer dereference that crashes or resets the device. Affected are Zephyr builds using the LwM2M engine with block-wise transfer handling, particularly NoSec deployments where CONFIG_LWM2M_DTLS_SUPPORT is disabled (it has no default, so this is a common configuration); an unauthenticated remote peer that can reach the LwM2M UDP socket - an on-path or address-spoofing attacker, or a bootstrap/lower-trust server - first exhausts the static Block1 context pool (CONFIG_LWM2M_NUM_BLOCK1_CONTEXT, default 3) with three incomplete block-wise writes, then sends a fourth first-block write to hit the unguarded store. The assessed impact is availability only (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 5.9), and no public exploit code was identified at time of analysis; the multi-request pool-exhaustion sequence is the main factor keeping complexity high.
Repeated network-interface link-down events can crash or reset devices running Zephyr RTOS v4.3.0 that keep a listening TCP socket open, because the BSD-socket layer parks a pending errno value in the net_context user_data field while the TCP core simultaneously expects that field to hold a parent context pointer; a second interface-down event forwards the stale integer to zsock_accepted_cb(), which dereferences it as a pointer and writes through it, producing a wild-pointer access and a kernel fatal error (denial of service, not attacker-directed memory corruption). The flaw is reachable by unauthenticated adjacent attackers who can force the link down repeatedly (CVSS 3.1 AV:A/AC:L/PR:N/UI:N, 6.5, availability-only impact), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Zephyr v4.3.1 and v4.4.x carry a follow-up change that clears the accept callback after the error path, reducing the issue to a narrow handshake-versus-interface-down race plus an unconditional getsockopt(SO_ERROR) read-back of the kernel pointer stored in user_data, so those lines are far less practically exploitable than v4.3.0.
An out-of-bounds read in the Zephyr RTOS CoAP link-format helper match_path_uri() (subsys/net/lib/coap/coap_link_format.c) allows an unauthenticated remote attacker to drive the URI comparison loop one or more bytes past the end of a Uri-Query href= option value by sending a GET /.well-known/core?href=/<prefix> request whose value is a strict prefix of a longer registered resource path. Only devices running the Zephyr CoAP server subsystem with CONFIG_COAP_SERVER_WELL_KNOWN_CORE enabled (the default) and at least one resource declaring struct coap_core_metadata attributes reach the vulnerable code path. The over-read is bounded - in practice a single byte, limited by the compared path length - reads only uninitialized stack tail rather than receive-buffer or attacker-controlled data, cannot influence the response, and yields undefined behaviour rather than information disclosure or a matching error; no public exploit code was identified at time of analysis, and the assessed severity is Low (CVSS 3.7).
A supervisor-mode out-of-bounds write exists in the Zephyr RTOS 802.15.4 L2 transmit path: ieee802154_send() copies packet data into a fixed 125-byte frame buffer without validating the packet length on the unfragmented code path. On builds with CONFIG_NET_L2_IEEE802154_FRAGMENT (enabled by default with CONFIG_NET_6LO), local code that opens a NET_AF_PACKET socket (NET_SOCK_RAW, which skips the 6LoWPAN encoder, or NET_SOCK_DGRAM, which returns early on the address-family check) bound to an 802.15.4 interface can send a payload larger than IEEE802154_MTU and corrupt memory adjacent to the transmit buffer pool, causing a crash or further compromise of kernel state. The flaw is not reachable from the radio because ieee802154_6lo_encode_pkt() length-checks IPv6 packets and forces fragmentation; in a CONFIG_USERSPACE build an unprivileged thread can reach it through the zsock_socket()/zsock_sendto() syscalls, though the overrun is bounded to roughly ll_hdr_len + 3 bytes with the default fixed-size net_buf configuration. No public exploit code was identified at time of analysis and the vendor patch is available (commit 3d4c6177d2dbd77d12d9b14cd75a00cdbd826227).
Denial of service in the Zephyr ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) lets a Wi-Fi-adjacent, unauthenticated attacker fault the device or permanently stop Wi-Fi reception in Zephyr builds (assessed range 4.2.0 through 4.4.1) that run an ESP co-processor over SPI with CONFIG_NANOPB_ENABLE_MALLOC selected. The driver takes a 16-bit TLV data_length straight off the wire and passes it to pb_istream_from_buffer() without validating it against the frame length, so pb_decode() can read roughly 62 KB past a 3188-byte stack object (CWE-125); the underlying half-duplex SPI aliasing bug lets the attacker steer the parser onto misaligned protobuf continuation bytes by getting the first fragment of a fragmented control response dropped mid-transmit, and the AP scan list the attacker can grow is the most convenient lever. Impact is limited to availability (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.3) with no disclosure or code execution; the high attack complexity reflects the timing race, no public exploit code identified at time of analysis, and the vendor has published a fix.
Concurrent writes to the same Internal Trusted Storage (ITS) UID in Zephyr RTOS can be encrypted with a duplicate AEAD nonce, because the default nonce provider secure_storage_its_transform_aead_get_nonce() keeps its counter in unsynchronized function-local statics (no lock). Affected are builds using the PSA ITS secure-storage transform with AES-GCM or ChaCha20-Poly1305, an application that writes the same UID from two threads at once, and one of the shipped log-structured back-ends (zms.c or the settings/NVS store) whose deferred garbage collection leaves both racing ciphertexts resident in the raw partition. The impact is cryptographic rather than direct code execution: nonce reuse under the same derived key leaks the XOR of the two plaintexts (potentially PSA persistent keys stored in ITS) and, for GCM, exposes the authentication key, allowing forgery of stored entries - but only for an adversary with local read access to the raw backing flash, and only where the same UID is written concurrently. CVSS is 5.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N), no CISA KEV listing, and no public exploit identified at time of analysis; risk is heavily gated by the narrow race window and the per-UID key salting that makes cross-UID collisions harmless. An upstream fix commit that serializes the provider with a mutex is available.
An out-of-bounds write of up to 895 bytes into static (.bss) memory can be triggered in Zephyr RTOS's Intel SEDI IPM driver (drivers/ipm/ipm_sedi.c) when the peer processor sets a doorbell payload length larger than the 128-byte incoming_data_buf. The vulnerable path is reachable when an application has registered an IPM receive callback via ipm_register_callback(), the driver's normal mode of use, and requires a local, highly privileged attacker (CVSS PR:H) with host-side ISH driver-level or raw BAR access to the device's memory-mapped register window, plus a production image built without CONFIG_DEBUG so the HAL's DBG_CHECK length guard is compiled away. The result is kernel data-structure corruption and a crash primitive - the overflow clobbers the driver context's k_sem and k_mutex and adjacent static data - but the flaw is platform-specific and locally scoped, so it is a moderate, defense-in-depth-relevant issue rather than an urgent internet-facing emergency; no public exploit identified at time of analysis, and an upstream fix commit is available.
A double-free (CWE-415) in Zephyr's experimental USB host stack lets a malicious or malformed USB peripheral crash the device: the stack frees the per-device configuration-descriptor buffer udev->cfg_desc on three error paths in usbh_device_set_configuration() but never clears the pointer, so the guarded cleanup in usbh_device_free() frees the same chunk again. Only builds with CONFIG_USB_HOST_STACK enabled are exposed, and because that stack is experimental and off by default most Zephyr deployments are unaffected; exploitation requires physical access to plug in the attacker-controlled device and, on v4.1.0-v4.3.x, a device-initiated removal or duplicate-connect event after a failed enumeration. With the default CONFIG_SYS_HEAP_HARDENING_BASIC the double free is caught and triggers k_panic() - a deterministic denial of service - while builds using CONFIG_SYS_HEAP_HARDENING_NONE or older releases corrupt the free list of the small 1024-byte usb_device_heap instead. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published a fix (commit d46a8c1f) and a GitHub security advisory, making this a genuine but low-priority issue given the physical-access and build-configuration prerequisites.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
An out-of-bounds read in Zephyr RTOS's gPTP (IEEE 802.1AS) announce-qualification routine lets an unauthenticated attacker with layer-2 adjacency to a vulnerable device send a single crafted Announce frame that drives the stack about 2 KB past the end of the received network buffer, potentially faulting the networking RX thread and causing a denial of service. The flaw affects only builds that enable the opt-in, experimental CONFIG_NET_GPTP option used in TSN/AVB deployments (Zephyr 1.13.0 up to before 4.4.2 per EUVD); default configurations are not vulnerable, and because gPTP frames go to a non-routed link-local multicast address, internet or routed exploitation is not possible. The impact is bounded by the assessed CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and no public exploit has been identified at time of analysis.
An out-of-bounds read in the Zephyr RTOS gPTP (IEEE 802.1AS) Ethernet layer lets an attacker on the same link crash-free but silently expose memory contents: a truncated Ethernet frame with ethertype 0x88F7 and fewer than 34 bytes of payload is accepted by gptp_handle_msg(), which dereferences a gPTP header pointer that extends past the received data and then retains the short packet for later state-machine parsing. Affected are Zephyr releases from 1.13.0 up to (but not including) 4.4.2 built with CONFIG_NET_GPTP on an interface configured as a gPTP port; no authentication or user interaction is required (PR:N/UI:N), though exploitation is limited by the adjacent-only vector and the requirement for a link that can deliver sub-minimum frames (for example the native_sim TAP driver or a MAC that accepts undersized frames). The impact is read-only and low (CVSS 3.1 base 3.1, C:L/I:N/A:N): under the default fixed-size buffer allocator only stale recycled buffer contents within the 128-byte fragment are disclosed, while a genuine out-of-bounds read requires the experimental CONFIG_NET_BUF_VARIABLE_DATA_SIZE allocator. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; an upstream fix commit and vendor advisory are available.
Physically attached USB hosts can crash Zephyr RTOS builds that use the ITE it82xx2 USB device-controller driver, because the driver re-initializes an already-pending delayed work item during a disable-then-enable cycle, corrupting kernel timeout and workqueue linked lists and causing a kernel panic. Affected builds are those running Zephyr 3.7.0 through versions below 4.4.2 with the it82xx2 UDC driver enabled, typically on hardware that faces a removable USB host — kiosks, field instrumentation, or development boards. Exploitation requires a direct physical USB connection (CVSS AV:P, score 4.6), delivers denial of service only with no confidentiality or integrity impact, and is not currently listed as actively exploited or accompanied by published exploit code.
A use-after-free write in the Zephyr RTOS ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) affects Zephyr 4.0.0 through 4.4.1 and allows a malicious USB host to create a kernel heap-corruption primitive on the device side. When a multi-packet OUT transfer is received on a non-control endpoint, the driver re-arms the endpoint to keep filling the same net_buf while simultaneously handing that buffer to the upper USB device stack, which may free and recycle it while DMA continues; the completing packet is also submitted a second time, corrupting the event slist and causing a double net_buf_unref(). Exploitation is physical (USB attach) with no authentication or user interaction required, giving a reliable denial of service and plausible adjacent-pool memory corruption; no public exploit code or CISA KEV listing was identified for this CVE at time of analysis.