Zephyrproject
Monthly
Zephyr's Bluetooth LE controller leaks a retained RX node when the Connected Isochronous Stream (CIS) Create control procedure is aborted through its "invalid PDU received" path, giving a radio-range attacker a denial-of-service primitive against affected devices. Any build with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is affected if it is mid-CIS-Create: against a peripheral the attacker sends a valid LL_CIS_REQ and then any unrelated LL Control PDU (for example LL_VERSION_IND) before the Host replies, while against a central a malicious peripheral simply answers LL_CIS_REQ with LL_UNKNOWN_RSP. In default builds the retained-node assertion fires immediately and produces a controller fatal error and usually a system reset from a single injected PDU; with CONFIG_BT_CTLR_ASSERT_DEBUG disabled, repeated connect-attack-reconnect cycles permanently drain the small LL notification pool until allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults, with recovery requiring a reboot. Only availability is impacted - the leaked node is orphaned and never reused or double-freed - and no public exploit identified at time of analysis. Exploitation requires the attacker to be within Bluetooth LE radio range of an unauthenticated, unencrypted ACL link; no pairing, encryption, or user interaction is needed.
System-wide denial of service can be triggered on Zephyr RTOS v4.4.0 or later builds for RISC-V Espressif SoCs (in-tree, the ESP32-C6 HPCORE) when CONFIG_USERSPACE is enabled: a local user-mode thread that has been granted the I2S device (PR:L) can issue a single i2s_trigger() call naming a direction the devicetree does not describe, causing a NULL pointer dereference in kernel mode (CWE-476). The impact is availability only-a NULL read with no attacker-controlled offset, no write primitive, and no information disclosure-but the default fatal-error handler halts the system, so an enabled user-mode thread can effect a system-wide denial of service. No public exploit code identified at time of analysis, and this is not confirmed actively exploited; real-world exposure is narrow because Xtensa Espressif targets do not support Zephyr userspace, ESP32-C5 does not select CONFIG_RISCV_PMP by default, and non-userspace builds can only pass the bad direction from trusted in-kernel code.
An out-of-bounds memory read in the Zephyr RTOS zbus proxy agent IPC backend allows a peer domain that already controls its own firmware - typically a second core on the same SoC - to leak a small amount of adjacent memory into the receiving domain's log output. The flaw is a non-NUL-terminated channel_name[] array being printed with a plain %s conversion on the frame-rejection error path; it is only reachable when CONFIG_ZBUS_PROXY_AGENT_IPC is built and logging is at warning level or higher (the default). Impact is bounded to limited information disclosure (CVSS 3.4, AV:L/PR:H, C:L/A:L) and a possible fatal fault if the scan leaves a mapped region; there is no public exploit identified at time of analysis and no confirmed active exploitation.
Predictable TCP initial sequence numbers in Zephyr RTOS allow off-path attackers to defeat RFC 6528 spoofing protection and perform blind TCP connection spoofing, data injection, or connection resets, but only on devices where the cryptographic random source fails exactly when the ISN secret key is first generated at boot. The flaw is a discarded return value from sys_csrand_get() that latches the 'key already generated' guard even on failure, leaving a 128-bit secret as all zeros for the entire boot; exploitation additionally requires the attacker to observe at least one ISN off-path and the spoofed peer to trust source addresses, and no public exploit was identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8), reflecting an unauthenticated remote issue whose high attack complexity and conditional preconditions keep it moderate rather than critical, and the signals converge on a conditional, moderate-severity issue rather than a top priority.
An out-of-bounds stack write in the Zephyr RTOS Goodix GT9xx touch driver (drivers/input/input_gt911.c) lets a malicious or misbehaving I2C touch controller overwrite up to 112 bytes of the gt911_process() stack frame with attacker-chosen data running at kernel privilege, potentially hijacking control flow on the host microcontroller. Only systems built with the GT9xx driver are affected, and reaching the defect requires physical/local access to the I2C bus (AV:P) - there is no network, USB, or syscall path - most plausibly on boards where the panel is a pluggable display module or shield rather than a soldered part. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the fix is a small one-line clamp and the same overflow can occur non-adversarially with a GT9271-class panel or a single corrupted status byte.
Out-of-bounds read of up to roughly 64 KiB in Zephyr's ITE IT8xxx2 SHI host-command backend allows an attacker who drives the SPI host controller to disclose adjacent embedded-controller SRAM to the host, or to fault the controller by reading past the end of SRAM. The root cause is a race: the 8-byte host-command header is copied from the SPI Rx FIFO directly into the shared in_msg buffer before the protocol version and derived packet length are validated, so a second transaction carrying data_len = 0xFFFF can deposit its header into a buffer that verify_rx() has already accepted; if those bytes land before the host-command thread assigns args.input_buf_size = rx_header->data_len, a registered handler is handed a 65535-byte length over a 256-byte buffer. Exploitation requires local control of the inter-processor SHI bus (a compromised host OS driving chip select and clock, or physical access to the SPI lines) plus a timing race the host can retry indefinitely, and is unauthenticated per the CVSS vector (PR:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Local user-mode threads in Zephyr RTOS builds that enable CONFIG_USERSPACE and CONFIG_SMBUS can invoke the smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() syscalls with an arbitrary pointer, silently unregistering SMBALERT or Host Notify callbacks that supervisor-mode code registered and thereby disabling alert handling system-wide; the same pointer can also be probed for valid kernel addresses because the syscall returns 0 on a hit versus -ENOENT on a miss. Exploitation is authenticated and local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, 4.4), requiring a user-mode thread that has already been granted the SMBus device object, and is limited to configurations using the Intel PCH SMBus driver with CONFIG_SMBUS_INTEL_PCH_SMBALERT or CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or the STM32 SMBus driver with CONFIG_SMBUS_STM32_SMBALERT; builds with CONFIG_ASSERT=y additionally turn a bogus pointer into a supervisor-mode fault and fatal system error, leaking which addresses are mapped. There is no impact on builds without CONFIG_USERSPACE or without an SMBus driver supporting SMBALERT/Host Notify, and no public exploit identified at time of analysis.
An out-of-bounds read in the Zephyr RTOS CoAP link-format helper match_path_uri() (subsys/net/lib/coap/coap_link_format.c) allows an unauthenticated remote attacker to drive the URI comparison loop one or more bytes past the end of a Uri-Query href= option value by sending a GET /.well-known/core?href=/<prefix> request whose value is a strict prefix of a longer registered resource path. Only devices running the Zephyr CoAP server subsystem with CONFIG_COAP_SERVER_WELL_KNOWN_CORE enabled (the default) and at least one resource declaring struct coap_core_metadata attributes reach the vulnerable code path. The over-read is bounded - in practice a single byte, limited by the compared path length - reads only uninitialized stack tail rather than receive-buffer or attacker-controlled data, cannot influence the response, and yields undefined behaviour rather than information disclosure or a matching error; no public exploit code was identified at time of analysis, and the assessed severity is Low (CVSS 3.7).
Denial of service in the Zephyr ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) lets a Wi-Fi-adjacent, unauthenticated attacker fault the device or permanently stop Wi-Fi reception in Zephyr builds (assessed range 4.2.0 through 4.4.1) that run an ESP co-processor over SPI with CONFIG_NANOPB_ENABLE_MALLOC selected. The driver takes a 16-bit TLV data_length straight off the wire and passes it to pb_istream_from_buffer() without validating it against the frame length, so pb_decode() can read roughly 62 KB past a 3188-byte stack object (CWE-125); the underlying half-duplex SPI aliasing bug lets the attacker steer the parser onto misaligned protobuf continuation bytes by getting the first fragment of a fragmented control response dropped mid-transmit, and the AP scan list the attacker can grow is the most convenient lever. Impact is limited to availability (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.3) with no disclosure or code execution; the high attack complexity reflects the timing race, no public exploit code identified at time of analysis, and the vendor has published a fix.
Concurrent writes to the same Internal Trusted Storage (ITS) UID in Zephyr RTOS can be encrypted with a duplicate AEAD nonce, because the default nonce provider secure_storage_its_transform_aead_get_nonce() keeps its counter in unsynchronized function-local statics (no lock). Affected are builds using the PSA ITS secure-storage transform with AES-GCM or ChaCha20-Poly1305, an application that writes the same UID from two threads at once, and one of the shipped log-structured back-ends (zms.c or the settings/NVS store) whose deferred garbage collection leaves both racing ciphertexts resident in the raw partition. The impact is cryptographic rather than direct code execution: nonce reuse under the same derived key leaks the XOR of the two plaintexts (potentially PSA persistent keys stored in ITS) and, for GCM, exposes the authentication key, allowing forgery of stored entries - but only for an adversary with local read access to the raw backing flash, and only where the same UID is written concurrently. CVSS is 5.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N), no CISA KEV listing, and no public exploit identified at time of analysis; risk is heavily gated by the narrow race window and the per-UID key salting that makes cross-UID collisions harmless. An upstream fix commit that serializes the provider with a mutex is available.
An out-of-bounds write of up to 895 bytes into static (.bss) memory can be triggered in Zephyr RTOS's Intel SEDI IPM driver (drivers/ipm/ipm_sedi.c) when the peer processor sets a doorbell payload length larger than the 128-byte incoming_data_buf. The vulnerable path is reachable when an application has registered an IPM receive callback via ipm_register_callback(), the driver's normal mode of use, and requires a local, highly privileged attacker (CVSS PR:H) with host-side ISH driver-level or raw BAR access to the device's memory-mapped register window, plus a production image built without CONFIG_DEBUG so the HAL's DBG_CHECK length guard is compiled away. The result is kernel data-structure corruption and a crash primitive - the overflow clobbers the driver context's k_sem and k_mutex and adjacent static data - but the flaw is platform-specific and locally scoped, so it is a moderate, defense-in-depth-relevant issue rather than an urgent internet-facing emergency; no public exploit identified at time of analysis, and an upstream fix commit is available.
A double-free (CWE-415) in Zephyr's experimental USB host stack lets a malicious or malformed USB peripheral crash the device: the stack frees the per-device configuration-descriptor buffer udev->cfg_desc on three error paths in usbh_device_set_configuration() but never clears the pointer, so the guarded cleanup in usbh_device_free() frees the same chunk again. Only builds with CONFIG_USB_HOST_STACK enabled are exposed, and because that stack is experimental and off by default most Zephyr deployments are unaffected; exploitation requires physical access to plug in the attacker-controlled device and, on v4.1.0-v4.3.x, a device-initiated removal or duplicate-connect event after a failed enumeration. With the default CONFIG_SYS_HEAP_HARDENING_BASIC the double free is caught and triggers k_panic() - a deterministic denial of service - while builds using CONFIG_SYS_HEAP_HARDENING_NONE or older releases corrupt the free list of the small 1024-byte usb_device_heap instead. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published a fix (commit d46a8c1f) and a GitHub security advisory, making this a genuine but low-priority issue given the physical-access and build-configuration prerequisites.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
An out-of-bounds read in Zephyr RTOS's gPTP (IEEE 802.1AS) announce-qualification routine lets an unauthenticated attacker with layer-2 adjacency to a vulnerable device send a single crafted Announce frame that drives the stack about 2 KB past the end of the received network buffer, potentially faulting the networking RX thread and causing a denial of service. The flaw affects only builds that enable the opt-in, experimental CONFIG_NET_GPTP option used in TSN/AVB deployments (Zephyr 1.13.0 up to before 4.4.2 per EUVD); default configurations are not vulnerable, and because gPTP frames go to a non-routed link-local multicast address, internet or routed exploitation is not possible. The impact is bounded by the assessed CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and no public exploit has been identified at time of analysis.
An out-of-bounds read in the Zephyr RTOS gPTP (IEEE 802.1AS) Ethernet layer lets an attacker on the same link crash-free but silently expose memory contents: a truncated Ethernet frame with ethertype 0x88F7 and fewer than 34 bytes of payload is accepted by gptp_handle_msg(), which dereferences a gPTP header pointer that extends past the received data and then retains the short packet for later state-machine parsing. Affected are Zephyr releases from 1.13.0 up to (but not including) 4.4.2 built with CONFIG_NET_GPTP on an interface configured as a gPTP port; no authentication or user interaction is required (PR:N/UI:N), though exploitation is limited by the adjacent-only vector and the requirement for a link that can deliver sub-minimum frames (for example the native_sim TAP driver or a MAC that accepts undersized frames). The impact is read-only and low (CVSS 3.1 base 3.1, C:L/I:N/A:N): under the default fixed-size buffer allocator only stale recycled buffer contents within the 128-byte fragment are disclosed, while a genuine out-of-bounds read requires the experimental CONFIG_NET_BUF_VARIABLE_DATA_SIZE allocator. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; an upstream fix commit and vendor advisory are available.
Heap memory exhaustion in Zephyr RTOS mcumgr SMP settings handlers allows unauthenticated attackers to trigger a monotonic heap leak by sending settings read, write, or delete commands that the application access hook rejects, ultimately depleting the kernel heap until the device must be rebooted. The three affected handlers - settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c - allocate buffers via k_malloc() but execute a direct return bypassing the end: cleanup label whenever CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK rejects a request via MGMT_CB_ERROR_RC. The vulnerability is availability-only with no memory corruption or information disclosure; no public exploit code or CISA KEV listing exists at time of analysis.
Type confusion in the Sierra Wireless HL78xx GNSS driver within Zephyr RTOS (4.4.0-4.4.1) allows an adjacent, unauthenticated attacker with GNSS signal-spoofing capability to drive the kernel-side NMEA parser into writing satellite data through a wild/garbage pointer, most likely crashing the device. The root defect is a struct member ordering invariant violation: the generic NMEA0183 match helper casts user_data directly to struct gnss_nmea0183_match_data, but hl78xx_gnss_data placed match_data as the second member (after const struct device), causing GGA/RMC callbacks to write fix data at wrong offsets and the GSV satellite callback to dereference a pointer constructed from non-pointer bytes. No public exploit exists; a vendor-released patch is available in Zephyr 4.4.2.
Bluetooth Classic L2CAP channel state confusion in Zephyr RTOS (versions 1.6.0 through pre-4.4.2) enables an adjacent unauthenticated peer to inject data PDUs into half-open L2CAP channels before configuration or security handshaking completes, forcing processing on stale or uninitialized channel fields. In the worst case, reused channel objects expose dangling _sdu reassembly buffer pointers, creating a memory-safety condition that causes channel and link teardown (denial of service) alongside unintended delivery of attacker-controlled data to upper-layer protocol handlers. No public exploit has been identified and the flaw is absent from CISA KEV; a vendor-released fix is available via Zephyr commit 2738ee9, targeting release 4.4.2.
TX packet pool exhaustion in Zephyr RTOS's IPv6 Neighbor Solicitation path allows an adjacent unauthenticated attacker to render a device permanently unable to transmit any network traffic. The leak in net_ipv6_send_ns() (subsys/net/ip/ipv6_nbr.c) occurs when an NS is already outstanding for a neighbor - each subsequent outbound packet during the ~3-second INCOMPLETE resolution window allocates a new net_pkt that is never released, silently consuming the fixed-size TX pool. With CONFIG_NET_PKT_TX_COUNT defaulting to as low as 4, a brief low-rate spoofed-source burst suffices to produce a complete, reboot-required network denial of service; no public exploit or active exploitation has been identified at time of analysis.
Ethernet bridge input processing in Zephyr RTOS leaks RX packet buffers when CONFIG_NET_ETHERNET_BRIDGE is enabled, allowing any adjacent L2 attacker to exhaust the fixed-size RX pool through a broadcast flood and halt all network reception until reboot. The root cause is eth_bridge_handle_locally() returning NET_OK without consuming the packet, so ethernet_recv() never frees the buffer. An unauthenticated attacker on the same Ethernet segment can emit broadcast or multicast frames with arbitrary EtherType values to permanently consume CONFIG_NET_PKT_RX_COUNT buffers one by one. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV.
Off-by-one out-of-bounds write in Zephyr RTOS's LwM2M JSON formatter allows a LwM2M server peer to corrupt one byte of memory adjacent to a STRING resource buffer by sending a WRITE payload whose string length exactly equals the buffer size. Affected devices are Zephyr LwM2M clients with the JSON content formatter enabled (cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*). The overflow deterministically writes a NUL byte past the buffer boundary, enabling potential crash or silent data corruption depending on memory layout; no public exploit has been identified at time of analysis, but the fix commit and security advisory are publicly visible.
Race condition in Zephyr RTOS's I3C IBI workqueue subsystem allows a physically-present attacker controlling an I3C peripheral to corrupt kernel memory structures, most realistically causing denial of service. The unsynchronized free-list (sys_slist_t) shared between ISR context and the workqueue handler thread creates a window where a work node can be handed to two consumers simultaneously or a garbage pointer can be dereferenced in a memcpy, producing an out-of-bounds write. No public exploit code has been identified and no CISA KEV listing exists; the patch wrapping all free-list operations in a k_spinlock is confirmed in upstream commit e87e7e2.
Use-after-free and double-free memory corruption in the Silicon Labs SiWx917 WiFi driver for Zephyr RTOS enables an adjacent unauthenticated attacker to corrupt the kernel networking buffer pool and crash the device. The driver's siwx91x_send() incorrectly releases a net_pkt owned by the L2 ethernet stack, causing use-after-free reads and a double-free when the caller accesses and unrefs the same packet; under concurrent network load, the trailing unref corrupts a live packet's reference count drawn from the recycled slab slot. No public exploit has been identified at time of analysis, but the vulnerable code path is compiled in by default and is exercisable via ordinary WiFi traffic that any adjacent-network peer can induce.
Zephyr RTOS's WireGuard subsystem incorrectly bypasses Poly1305 authentication for keepalive packets, allowing a network attacker to spoof VPN connection status events on affected embedded devices. The flaw in `wg_process_data_message()` accepted any 16-byte type-4 transport-data message and returned before invoking `wg_decrypt_packet()`, meaning the Poly1305 MAC was never verified - only a cleartext receiver-index lookup and a non-cryptographic expiry check were performed. Exploitation is constrained to integrity spoofing of the `NET_EVENT_VPN_CONNECTED` management signal; no traffic injection, key disclosure, or session takeover is possible, and no public exploit has been identified at time of analysis.
Zephyr RTOS's WireGuard VPN receive handler in wg_process_data_message() commits permanent peer-state mutations - endpoint roaming update, liveness timer refresh, and keypair promotion - before validating the anti-replay counter, allowing an on-path attacker who captures a single valid encrypted datagram to replay it from a spoofed source address and hijack the tunnel endpoint. Because AEAD decryption succeeds for any authentic ciphertext regardless of freshness, the spoofed replay is processed as legitimate and irreversibly alters peer state before the replay check fires and returns -EINVAL. No public exploit has been identified at time of analysis; patch is available via upstream commit 260c32ef.
Out-of-bounds read and in-object write in the Zephyr RTOS IEEE 1588 PTP stack affects all Zephyr versions with CONFIG_PTP enabled, exploitable by any unauthenticated attacker with Layer 2 adjacency. The PTP_MGMT_TIME management-id case in tlv_mgmt_post_recv() omits the length guard present for every sibling case, allowing a crafted short TLV to drive an 8-byte over-read and bounded write-back within the same struct ptp_msg allocation. No public exploit has been identified at time of analysis, and impact is constrained to minor adjacent-memory disclosure and corruption of the device's parsed management timestamp - no crash or past-allocation corruption is reachable.
Out-of-bounds read in Zephyr RTOS's LoRaWAN TS004 Fragmented Data Block Transport handler allows a party holding valid device session keys to trigger a bounded overread of up to 232 bytes beyond the 255-byte `MacCtx.RxPayload` static buffer, with overread data silently written into decoder buffers and the FUOTA flash image rather than returned to the attacker. The vulnerable function `frag_transport_package_callback()` in `subsys/lorawan/services/frag_transport.c` casts `rx_buf + rx_pos` to fixed-size structs and passes the pointer to the fragment decoder without first verifying that sufficient payload bytes remain. No public exploit is identified and this CVE is not listed in the CISA KEV catalog; CVSS 3.1 rates the vulnerability 3.1 (Low), reflecting the high-privilege access barrier and constrained, non-disclosing impact.
Out-of-bounds read in Zephyr RTOS's LoRaWAN clock synchronization service allows a malicious or compromised LoRaWAN application server to corrupt the target device's internal time offset by sending a crafted short AppTimeAns frame. The over-read is bounded by a 255-byte static backing buffer so no crash occurs, and the stray bytes are never transmitted back to the attacker, eliminating any information disclosure. Impact is confined to a minor, device-local clock integrity issue - the device's time estimate may silently diverge if a garbage time-correction value happens to match the pending token. No public exploit identified at time of analysis, and no CISA KEV listing.
Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.
NULL pointer dereference in the Zephyr RTOS OCPP 1.6 client allows a malicious or compromised OCPP central system - or a man-in-the-middle on an unencrypted ws:// connection - to remotely crash the OCPP reader thread of an EV charge point by returning a malformed CALLRESULT uid field. Impact is availability-only and platform-conditional: on MMU/MPU-equipped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION-enabled Zephyr targets, the fault invokes the fatal handler and produces a remote denial of service; on bare-metal targets where address 0 is readable, the call returns 0 and is benign. No public exploit is identified at time of analysis, and the vendor-supplied patch at the referenced commits is known to be incomplete - a second unguarded strtok_r/atoi pair in the same function path remains exploitable via a uid containing one token but no second hyphen-delimited segment.
Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.
Out-of-bounds write in Zephyr RTOS's ext2 filesystem driver enables supervisor-mode memory corruption when a device mounts a crafted ext2 image from a physical storage medium such as an SD card. The driver's superblock validation function omits bounds-checking the s_log_block_size field, allowing an attacker-controlled value to produce an inflated block size that silently misconfigures the kernel memory slab allocator beyond its static backing buffer, with impact ranging from denial of service to potential code execution in kernel mode. No confirmed active exploitation or public POC is identified at time of analysis; a vendor patch is available as upstream commit f270f4bd0e59585da31e1fbaa79c5abf73f1364b.
Zephyr RTOS's Hearing Access Service (HAS) GATT peripheral crashes when a previously bonded Bluetooth peer reconnects during a boot-time race window before bt_has_register() completes service initialization. The security_changed() callback - registered unconditionally via BT_CONN_CB_DEFINE - fires against NULL attribute pointers, triggering either a kernel assertion or a NULL dereference in bt_gatt_is_subscribed(). With CVSS AV:A/AC:H and confirmed DoS-only impact, this represents a medium-severity availability risk against embedded hearing-aid devices running Zephyr 3.6.0 through 4.4.1; no public exploit code has been identified, and a vendor patch is confirmed at 4.4.2.
Zephyr RTOS versions 4.3.0 through 4.4.1 leak 8 bytes of uninitialised kernel stack memory per MIDI 2.0 discovery request through the UMP Stream responder library. Two reply-packet builder functions declare their result struct without zero-initialisation, causing stale stack contents in the trailing two 32-bit words to be transmitted verbatim over the wire. The default unauthenticated Network MIDI 2.0 UDP endpoint exposes this to any remote peer; the request is freely repeatable, enabling accumulation of stack disclosures. No public exploit has been identified at time of analysis, and KEV status is absent.
Kernel memory disclosure and denial-of-service in Zephyr RTOS's mbox_send() syscall verifier stem from a time-of-check/time-of-use (TOCTOU) race in z_vrfy_mbox_send() (drivers/mbox/mbox_handlers.c), present in versions 3.0.0 through 4.4.2 on CONFIG_USERSPACE builds. An unprivileged userspace thread can race a second thread in the same address space to replace the validated msg->data pointer with a supervisor-mode address after the bounds check completes, causing the underlying driver to perform a supervisor-context read from an attacker-chosen kernel address. The upstream fix (commit ab35eacc) is confirmed available; no public exploit is identified at time of analysis.
Permanent Wi-Fi denial-of-service in the Infineon AIROC driver shipped with Zephyr RTOS 3.6.0 through 4.4.1 allows a Wi-Fi-adjacent attacker to exhaust a fixed 20-buffer transmit/receive pool by inducing repeated synchronous WHD send failures, each of which leaks one buffer from airoc_pool without releasing it. Once the pool is fully exhausted, both transmit and WHD-driven receive paths fail, severing all Wi-Fi connectivity until the device is physically rebooted. No active exploitation is recorded in CISA KEV and no public exploit code has been identified, but the defect can also manifest organically over a device's operational lifetime through ordinary transient failures.
Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.
Out-of-bounds stack read and write in the WNC-M14A2A LTE-M modem driver (wncm14a2a.c) within Zephyr RTOS versions 1.13.0 through below 4.4.2 allows a rogue cellular base station or RF attacker to crash the modem RX thread and leak adjacent stack memory without any application interaction. The defect fires automatically on receipt of an unsolicited %NOTIFYEV: event whose payload exceeds 39 bytes and lacks a quote character within the linearized region, causing scanning loop indices to walk past the fixed 40-byte stack buffer. While the write primitive is weakly controlled — limiting demonstrated impact to denial of service and stack disclosure — the CVE is tagged RCE by reporters, though the description explicitly states memory-safe code execution has not been demonstrated. No public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds read in Zephyr RTOS's 6LoWPAN IPHC uncompression layer allows any unauthenticated attacker on the same IEEE 802.15.4 radio link to crash the receiving device by transmitting a single malformed frame. The flaw resides in get_ihpc_inlined_size() (subsys/net/ip/6lo.c), where a 4-bit index derived directly from the received IPHC dispatch word can reach values 13-15, all beyond the 13-entry da_inline_size_table, producing an out-of-bounds read that corrupts the computed inline size and subsequently underflows a size_t difference. No public exploit or CISA KEV listing exists at time of analysis; the fix is confirmed upstream.
Interrupt-storm livelock in Zephyr RTOS's ARM PL011 UART driver (versions 1.14.0 through 4.4.1) allows an attacker controlling the serial peer to permanently hang the CPU by injecting line errors that trigger an error interrupt the ISR never clears. The root cause is that pl011_isr() acknowledged only the CTS modem-status interrupt and never wrote the UARTICR register for error bits (framing, parity, break, overrun), leaving the interrupt line permanently asserted and causing the CPU to re-enter the ISR indefinitely. Exploitation is gated by a non-default configuration requirement - the error interrupt path is off by default and no in-tree Zephyr subsystem enables it - so only embedded applications explicitly calling uart_irq_err_enable() on a PL011 interrupt-driven port are at risk. No public exploit or CISA KEV listing exists at time of analysis.
Infinite loop denial of service in the Zephyr RTOS Bluetooth GATT client allows an unauthenticated adjacent attacker to permanently hang the Bluetooth host processing thread by sending a crafted ATT Read By Type Response with a zero-length stride value during standard descriptor discovery. Affected targets - which span all Zephyr versions per the wildcard CPE - face a hung BT subsystem and likely a watchdog reset on constrained embedded hardware, rendering Bluetooth functionality inoperative. No public exploit code or CISA KEV listing exists at time of analysis, but the upstream commit diff publicly discloses the exact offending code path, substantially lowering the barrier to exploit development.
Out-of-bounds write in Zephyr RTOS's llext subsystem allows a local attacker with low privileges to corrupt supervisor-context memory by loading a crafted relocatable ELF extension on Xtensa targets. The vulnerability in llext_link_plt() (subsys/llext/llext_link.c) occurs before any extension code executes - at link time - meaning sandbox protections are bypassed entirely. Exploitation complexity is high (CVSS AC:H) due to constraints on the write value, no public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to deployments using llext on Xtensa architecture.
Concurrent TLS handshakes on Zephyr RTOS devices built with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE cause a deterministic kernel panic and device reset via a NULL pointer dereference in the uninitialized credential mutex wait queue. The PSA Protected Storage credential backend in all affected Zephyr builds declared its serialization mutex without proper initialization, leaving its dlist sentinels as NULL; the fault triggers only on first contention but is fully deterministic once two threads race to acquire the lock. No public exploit has been identified and the issue is not in CISA KEV, though no exploit sophistication is required beyond opening multiple simultaneous TLS connections.
Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.
Out-of-bounds heap write in Zephyr RTOS's USB device-next CDC NCM class handler allows any physical USB host to corrupt the device's shared network buffer pool by issuing standard GET_NTB_PARAMETERS or GET_NTB_INPUT_SIZE control requests with a wLength field smaller than the response structure size. The overflow is bounded at up to 27 bytes and writes only fixed device constants, making its primary impact denial of service of the USB stack rather than arbitrary code execution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, exploitation requires only physical USB access to a device built with the opt-in device_next stack and CDC NCM class.
NULL pointer dereference in Zephyr RTOS's experimental device_next USB DFU class crashes any device where DFU download is enabled when a USB host sends a zero-length DFU_DNLOAD terminator after initiating a valid transfer. The result is a fatal CPU fault causing device crash or reset - impact is strictly limited to availability, with the vendor and commit diff explicitly confirming no memory corruption or information disclosure. No public exploit has been identified at time of analysis, and exploitation requires physical control of the attached USB host.
Double-free (CWE-415) and use-after-free read (CWE-416) vulnerabilities in the Realtek BEE Bluetooth HCI driver within Zephyr RTOS expose affected devices to memory pool corruption and likely crashes when an adjacent Bluetooth peer drives heavy transmit activity toward resource-exhaustion error conditions. The bt_hci_bee_send() function in hci_bee.c violated the bt_hci_driver_api buffer-ownership contract by routing all error exits through a shared cleanup label that unconditionally called net_buf_unref(), while the Zephyr host TX path also unrefs the buffer on error return - resulting in a double free of the same net_buf and a subsequent read of freed memory via a LOG_ERR call compiled in at the default error log level. An upstream fix is confirmed via Zephyr project commit 9a684b5c314fb1d8670b01f7b6c4450a9353906c; no formally released patched version has been independently confirmed, and no public exploit has been identified at the time of this analysis.
Uninitialized-memory and out-of-bounds read in the UpdateHub OTA client of Zephyr RTOS allows a malicious or on-path UpdateHub server to crash the device update thread via a crafted probe response, producing a network-triggerable denial of service. The flaw exists in z_impl_updatehub_probe() within subsys/mgmt/updatehub/updatehub.c, where metadata_copy is allocated with k_malloc (leaving heap unzeroed) and filled via memcpy without a NUL terminator; a subsequent strlen() then scans into uninitialized heap, producing an over-long length fed to json_obj_parse(). No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but it is remotely triggerable against Zephyr devices running UpdateHub without DTLS transport protection.
Out-of-bounds memory read and write in the Zephyr RTOS SF32LB MPI QSPI NOR flash driver allows a low-privileged thread, when explicitly granted flash device access in a CONFIG_USERSPACE build, to disclose arbitrary CPU-addressable memory or corrupt flash and invalidate cache beyond the mapped flash window. The root cause is a signed/unsigned type confusion in the offset bounds check: a crafted negative off_t value converts to a large unsigned integer and the subsequent addition wraps to a small result that passes the check, allowing memcpy to read from or program flash at attacker-controlled addresses. No public exploit code has been identified at time of analysis; exploitation is nonetheless mechanically straightforward for any attacker familiar with signed/unsigned integer confusion vulnerabilities.
Use-after-free in Zephyr RTOS kernel queue peek operations (z_impl_k_queue_peek_head and z_impl_k_queue_peek_tail in kernel/queue.c) allows a local low-privileged thread to obtain a dangling pointer to freed heap memory by winning a race against a concurrent k_queue_get call on a shared queue. Successful exploitation - requiring SMP or preemptive concurrency - can leak a stale heap pointer or crash the system when the returned dangling pointer is subsequently consumed as a live buffer in the net_buf, Bluetooth, USB, or networking subsystems. No public exploit exists and no active exploitation is confirmed; CVSS scores this at 3.6 (Low), accurately reflecting the narrow race window and local-only attack surface.
Use-after-free in Zephyr RTOS 4.4.0's Bluetooth ATT host layer (subsys/bluetooth/host/att.c) allows an adjacent unauthenticated peer to crash the Bluetooth host or potentially corrupt live memory by disconnecting while an ATT PDU is in-flight. The tx_meta_data_storage[] array retains a dangling att_chan pointer after L2CAP tears down and frees the channel slab slot, and the deferred att_tx_destroy_work_handler running on the system workqueue dereferences that freed pointer. No pairing or special privileges are required - a routine ATT connection is sufficient to reach the vulnerable code path. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
PSA Crypto key slot exhaustion in Zephyr's Bluetooth Mesh subnet.c permanently leaks one key slot on every subnet key teardown when CONFIG_BT_MESH_PRIV_BEACONS is enabled (the default). Devices running Zephyr 3.6.0 through 4.4.x are affected: a provisioner or network administrator with the node's device key can trigger the leak via Config Server NetKey Delete, Key Refresh Procedure, or reprovisioning over the Bluetooth Mesh network. With the default pool of 16 PSA key slots, roughly a dozen such operations exhaust the pool, preventing subnet creation and potentially starving other on-device PSA consumers until a reboot. No public exploit or CISA KEV listing exists; real-world impact is constrained by the high-privilege and proximity requirements.
Out-of-bounds read in Zephyr RTOS DHCPv4 client (versions 1.7.0 through 4.4.x) allows an adjacent-network attacker to crash the DHCP client or leak adjacent pointer contents by sending a crafted DHCP reply with a message-type value greater than 8. The defect is a classic sizeof-vs-ARRAY_SIZE confusion: the bounds guard compares a raw msg_type byte against the byte-size of a pointer array (32 or 64, depending on architecture) rather than its element count of 8, so values 9-31/63 bypass the check and cause a wild-pointer dereference inside a debug log call. Exploitation is gated on a non-default build configuration (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), substantially reducing the real-world attack surface. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Bluetooth GATT notification and indication paths in Zephyr RTOS 2.6.0 through 4.4.x skip the application-configured encryption, authentication, and LESC security requirements for characteristic values when the application follows the documented idiom of passing the Characteristic Declaration attribute to the notify/indicate APIs. A remote Bluetooth peer within radio range can connect without pairing and trigger the server to emit protected characteristic values over an unsecured link by writing the Client Characteristic Configuration descriptor, achieving an access-control bypass and information disclosure. No public exploit is identified at time of analysis; exploitation requires adjacent network access and specific application configuration.
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
Denial of service in Zephyr's Synopsys DesignWare I2C driver (slave mode) enables an I2C master on the same physical bus to cause permanent failure of the write_requested() callback due to a missing START_DET interrupt enable. This halts all subsequent write transactions and desynchronizes higher-layer framing until device reset. No public exploit identified; patch available from vendor.
Denial of service in Zephyr RTOS versions before 4.5.0 occurs when mounting a crafted ext2 filesystem with zero values in superblock fields s_blocks_per_group or s_inodes_per_group. An attacker with physical access via removable media can trigger a division-by-zero fault on ARM Cortex-M targets, causing a system crash. No other impact beyond availability; no active exploitation or public exploit is known.
Divide-by-zero in Zephyr's DesignWare SPI driver exposes kernel crash to locally-authorized userspace threads on all releases through v4.4.0. The spi_transceive syscall verify handler in spi_handlers.c copies the caller-supplied spi_config from userspace without validating the frequency field, allowing a thread with SPI device object access to pass frequency=0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(), which raises a CPU exception on Cortex-M Mainline and ARC platforms and halts the system. No public exploit has been identified at time of analysis; exploitation is gated behind a non-default build configuration and explicit privilege grant.
Kernel heap exhaustion in Zephyr RTOS affects all builds with CONFIG_USERSPACE enabled from v1.12.0 through v4.4.1, allowing any low-privilege user thread to permanently leak kernel memory by supplying a forged object handle to k_poll(). The z_vrfy_k_poll() syscall verifier allocates a kernel-side event copy but, prior to the fix, killed the calling thread via K_OOPS without freeing that buffer - a path any user thread can trigger repeatedly. By spawning additional threads that inherit the parent's resource_pool, an attacker can multiply the leak rate until the shared kernel heap is depleted, causing system-wide denial of service affecting queues, message buffers, and all future k_poll calls. No public exploit code or CISA KEV listing has been identified at time of analysis.
Zephyr RTOS Bluetooth Mesh PB-ADV provisioning can be permanently denied on any affected device within BLE advertising range by an unauthenticated remote attacker exploiting a timer-reset logic flaw in subsys/bluetooth/mesh/pb_adv.c. The watchdog timer governing protocol timeouts was rescheduled unconditionally before validity checks, allowing an attacker to hold a dead provisioning link open indefinitely by sending FCS-valid PDUs faster than the 60-120 second timeout interval. The device's unprovisioned beacon is suppressed and all new Link Open requests are rejected for as long as the attacker transmits, rendering the device permanently un-provisionable without a reboot. No public exploit is identified and the vulnerability is not listed in CISA KEV, though the attack requires no authentication and low complexity to execute from within BLE range.
Persistent denial of service in the NXP LPUART serial driver for Zephyr RTOS allows an unprivileged userspace thread to deterministically crash the entire embedded system by issuing a uart_configure() call with an unsupported parameter value while CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled. The driver's configure path calls LPUART_Deinit() before validating the requested configuration, gating the peripheral clock; if validation then rejects the parameters, the clock is never restored, and any subsequent LPUART register access - from any thread or interrupt handler - triggers a hard fault and system reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fault path is trivially and deterministically reproducible from userspace on affected NXP MCU targets.
NULL pointer dereference in Zephyr RTOS's syscall verifier allows an unprivileged user-mode thread to crash the kernel across the userspace security boundary. The z_vrfy_k_thread_name_copy() verification handler in kernel/thread.c incorrectly guards against the caller-supplied thread pointer being NULL rather than the ko pointer returned by k_object_find(), so any non-NULL but unregistered address bypasses the check and triggers a supervisor-mode NULL dereference that halts or reboots the system. Affecting Zephyr v2.0.0 through v4.4.0 when built with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled, no public exploit code and no CISA KEV listing have been identified at time of analysis, but the one-syscall reproducibility makes this straightforward to trigger in qualifying builds.
Denial of service in Zephyr RTOS's Nuvoton NuMaker HSUSBD USB device-controller driver allows a physical or adjacent USB host to permanently wedge the device's USB control endpoint. The driver unconditionally arms the control Data IN stage without accounting for the hardware's inability to disarm an already-armed transfer, so a host that cancels an in-flight control transfer and then re-issues a SETUP packet drives the driver out of sync. Repeated cancel-and-re-SETUP cycles cause the control endpoint to NAK every subsequent transfer, rendering the USB function non-operational until a USB reset or re-plug. No public exploit identified at time of analysis.
Out-of-bounds stack write in Zephyr's nRF70 Wi-Fi driver exposes embedded systems to memory corruption when the nRF70 co-processor returns a power-save event with more than eight TWT flow entries. The vulnerable function `nrf_wifi_event_proc_get_power_save_info()` blindly copies co-processor-supplied TWT entries into a fixed 8-element stack array without validating `num_twt_flows` against `WIFI_MAX_TWT_FLOWS`, enabling heap/stack corruption of approximately 40 bytes per excess entry. No public exploit code exists and the flaw is not listed in CISA KEV, but the adjacent-network attack vector and the indirect over-the-air influence path via a rogue AP manipulating TWT sessions make this a meaningful risk in Wi-Fi 6 (802.11ax) deployment environments running Zephyr with `CONFIG_NRF70_STA_MODE`.
Use-after-free and double-free in Zephyr RTOS's experimental USB host stack (CONFIG_USB_HOST_STACK, introduced in v4.4.0) allows an attacker with physical USB access to crash the target device or corrupt live kernel slab objects by bouncing a USB device connection to trigger a second removal event after the slab has already been freed. The flaw exists because usbh_device_disconnect() frees the root usb_device slab object without clearing the cached ctx->root pointer, and UHC controller drivers (uhc_max3421e, uhc_mcux_common) emit UHC_EVT_DEV_REMOVED directly from hardware line-state with no debounce or re-entry guard. No public exploit identified at time of analysis, and no CISA KEV listing; the physical-access prerequisite substantially constrains the realistic attacker population.
Kernel denial-of-service in Zephyr RTOS v4.4.0's Dhara flash translation layer driver crashes the system during FTL disk initialization when a flash error coincides with the journal-resume checkpoint scan. The driver's dhara_nand_read/erase/prog/copy callbacks unconditionally dereference the caller-supplied err pointer, but the upstream Dhara library legitimately passes NULL during its binary search in find_last_checkblock(), triggering a NULL write and kernel fault. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; exploitation is gated on specific flash media conditions (uncorrectable ECC, bad block, or induced fault) occurring on a checkpoint page at mount time, constraining real-world risk to physical or supply-chain threat models.
Out-of-bounds read in Zephyr RTOS's mDNS detection logic crashes devices resolving short-suffix hostnames when CONFIG_MDNS_RESOLVER is compiled in. The flaw in dns_resolve_name_internal() reads a fixed 7 bytes from a suffix pointer regardless of the actual string length, causing a 1-2 byte over-read past the NUL terminator for suffixes like .org, .com, .net, or .io. Under the specific runtime condition of a tightly-sized allocation adjacent to an unmapped boundary (guard page, MPU domain, or ASAN), the over-read faults and crashes the device; no public exploit has been identified at time of analysis and CVSS 3.7 with AC:H accurately reflects the narrow crash preconditions.
NULL pointer dereference in the Zephyr RTOS MAX32xxx USB device controller driver (udc_max32.c) crashes devices running Zephyr v4.4.0 when a physically connected USB host aborts an in-flight EP0 control transfer by sending a new SETUP packet - a completely legal USB protocol action. The race condition between interrupt-queued transfer-completion events and asynchronous FIFO draining by the driver thread causes net_buf_add(NULL, ...) when udc_buf_get() returns NULL on an empty FIFO, producing a near-NULL pointer dereference and device fault. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis; real-world risk is constrained by the physical access prerequisite and the specific MAX32xxx hardware dependency.
Use-after-free in Zephyr's asynchronous SNTP client (sntp_close_async, v4.2.0-v4.4.0) can be triggered remotely by any network peer or off-path attacker capable of dropping or delaying UDP NTP responses, exploiting a race between the system workqueue thread and the socket-service poll thread. The most probable outcome is a crash of the networking subsystem thread (denial of service); where the freed net_context pool slot is rapidly reallocated, memory corruption is possible. The vulnerability is on the normal SNTP timeout path, making it reliably and periodically triggerable when NET_CONFIG_SNTP_INIT_RESYNC is enabled. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition in Zephyr RTOS Bluetooth Classic RFCOMM host stack (v4.4.0 and earlier) permanently wedges session state and exhausts the fixed bt_rfcomm_pool when a peer-transmitted DISC frame for dlci 0 collides with a simultaneous local-initiated teardown. The underlying L2CAP channel is never released and the session slot is never reclaimed, eventually denying RFCOMM service to the targeted peer across repeated occurrences. No public exploit identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) with AV:A/AC:H accurately reflects both the Bluetooth adjacency prerequisite and the high-complexity timing race required.
Denial of service in Zephyr RTOS v4.4.0 allows an attacker with access to a serial, UART, or shell-console interface to crash an affected embedded device by exhausting the MCUmgr shared buffer pool and triggering a NULL pointer dereference. The defect in mcumgr_serial_process_frag() (CWE-476) was introduced during the MCUmgr rework and manifests in default builds where assertion checks are compiled out, making the write-through-NULL a hard fault rather than a caught assertion. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but exploitation is straightforward for any attacker with interface access.
Forged IPv6 Neighbor Discovery acceptance in the Zephyr RTOS network stack (all releases through v4.4.0) lets an adjacent on-link attacker inject spoofed Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages because an operator-precedence bug in subsys/net/ip/ipv6_nbr.c silently skips every RFC 4861 sanity check whenever the (always-present) ICMPv6 code is 0. Because the bypassed checks include the Hop-Limit==255 on-link proof, even off-link/remote attackers may have forged ND packets accepted, enabling default-router/DNS/SLAAC hijacking and neighbor-cache poisoning for man-in-the-middle, redirection, and denial of service. A vendor patch exists (commit 095f064c) but there is no public exploit identified at time of analysis and the issue is not in CISA KEV.
USB CDC-NCM network driver in Zephyr RTOS through v4.4.0 permanently deadlocks the shared network egress thread when a USB bus suspend coincides with outbound device traffic, requiring a reboot to recover. The defect in `cdc_ncm_send()` ignores the return value of `usbd_ep_enqueue()` and unconditionally blocks on a completion semaphore that only the (never-fired) bulk-IN ISR can signal - halting not just CDC-NCM traffic but all egress on other interfaces sharing the TX thread. No public exploit code or active exploitation has been identified; the trigger is routine USB host power management, making this an availability risk for any embedded Zephyr device using USB virtual Ethernet.
NULL pointer dereference in the Zephyr Bluetooth LE Audio Basic Audio Profile unicast client crashes devices running Zephyr v4.3.0 and v4.4.0 (and earlier) when connected to a malicious or buggy remote ASCS server. The handler unicast_client_ep_qos_state() writes attacker-controlled QoS fields through stream->qos without verifying the pointer is non-NULL - a condition that legitimately exists during the window between bt_bap_stream_config() and unicast_group_add_stream(). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but CVSS adjacency (AV:A) and no-auth (PR:N) make it exploitable by any device within Bluetooth LE radio range acting as a rogue ASCS server.
Out-of-bounds write in Zephyr RTOS's Microchip SERCOM-G1 UART driver (introduced in v4.4.0) allows an adjacent attacker who can send serial data to corrupt one byte of memory immediately beyond the caller-supplied RX buffer, potentially causing a crash or denial of service. The flaw exists only when CONFIG_UART_MCHP_ASYNC is enabled (non-default on in-tree PIC32CM-JH board configs) and the consuming application calls uart_rx_enable() with a one-byte buffer - a narrow but real embedded firmware scenario. No exploit code is publicly available and this vulnerability is not listed in CISA KEV; the upstream fix has been committed but a tagged patched release version has not been independently confirmed.
Infinite-loop denial of service in the Zephyr RTOS PL011 UART driver (v4.1.0-v4.4.0) permanently stalls any thread that calls uart_irq_tx_enable() - including the Bluetooth HCI H4 send path - when CTS hardware flow control is enabled and the wired peer withholds CTS during transmission. The root cause is a software workaround loop (CWE-835) that compensates for the PL011 controller's level-transition TX interrupt behavior but never exits when pl011_fifo_fill() returns 0 due to a blocked CTS line. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; exploitation requires physical or hardware-adjacent control of the UART CTS pin, materially constraining real-world risk.
Use-after-free in Zephyr RTOS's ICMPv4 echo handler allows any unauthenticated remote host to trigger memory corruption or a crash by sending a standard ICMP ping to an affected device. The defect exists in all versions from v1.14 (2019) through v4.4.0, where `icmpv4_handle_echo_request()` reads from a freed `net_pkt` struct after transferring packet ownership to the TX path - violating a contract explicitly documented in `net_core.c`. No public exploit code exists and this CVE does not appear in CISA KEV, but the zero-privilege, network-reachable attack surface makes it a meaningful risk for internet-exposed embedded and IoT deployments running Zephyr with ICMP statistics enabled.
Use-after-free in Zephyr's IPv4 IGMP implementation (igmp_send(), subsys/net/ip/igmp.c) allows a remote unauthenticated attacker to trigger undefined behavior and sporadic denial-of-service crashes on devices running Zephyr v2.6.0 through v4.4.0. The flaw arises because the network packet's interface pointer is re-read via net_pkt_iface(pkt) after net_send_data() may have already released the packet's last reference, returning the slab block to the free list. No public exploit code exists and the vulnerability is not in CISA KEV; however, the remote trigger path via IGMP membership queries (224.0.0.1) requires no authentication, and the analogous IPv6 MLD path (mld_send) carries the same unpatched pattern.
Use-after-free in Zephyr RTOS v4.4.0 on Xtensa/MMU targets allows privileged kernel code to corrupt page tables or trigger a fatal MMU exception by destroying a memory domain without unlinking it from the global xtensa_domain_list. The dangling list node persists after arch_mem_domain_deinit() sets domain->arch.ptables to NULL, so any subsequent arch_mem_map() or arch_mem_unmap() call traverses the stale entry and dereferences the freed pointer - producing at minimum a denial-of-service kernel crash (NULL pointer deref) and at worst page-table memory corruption that undermines userspace process isolation. No public exploit code exists and no CISA KEV listing is present; however the integrity and availability impact (I:H, A:H) in a real-time OS kernel elevates practical severity beyond the 6.3 base score for affected embedded deployments.
Use-after-free in Zephyr RTOS's native TCP2 stack allows a concurrent connection teardown - triggered by ordinary TCP traffic from an adjacent-network peer - to invalidate a cached iterator pointer in net_tcp_foreach(), crashing the system or causing the iterator callback to operate on attacker-influenced reallocated memory. All Zephyr releases from the TCP2 stack introduction in 2020 through v4.4.0 (inclusive) are affected. No public exploit has been identified at time of analysis and no CISA KEV listing exists; the primary real-world risk is denial of service against embedded or IoT devices with TCP networking and shell access exposed on an adjacent network segment.
Integer underflow in Zephyr RTOS Bluetooth Mesh solicitation handling (versions ≤ 4.3.0) allows any physically proximate, unauthenticated BLE device to corrupt memory via a crafted advertising PDU, potentially causing denial of service or arbitrary code execution on the target device. The flaw resides in bt_mesh_sol_recv() within the OD Private Proxy Server feature and requires no prior pairing or device association to trigger. No public exploit has been identified at time of analysis and EPSS probability is low at 0.02%, but the combination of zero-interaction exploitation and RCE impact on embedded IoT devices warrants prioritization where this configuration is deployed.
Zephyr RTOS sockets created with IPPROTO_TLS_1_3 can negotiate TLS 1.2 connections when both TLS versions are enabled in Kconfig, because socket-level protocol selection is not propagated to mbedTLS's minimum version enforcement. Applications explicitly requesting TLS 1.3 may silently fall back to TLS 1.2, exposing them to known TLS 1.2 weaknesses such as POODLE or truncation attacks. Remote unauthenticated attackers can exploit this via network-level protocol downgrade during the TLS handshake.
Device unique identifiers in the preloader of Openwrt, Android, Yocto, RDK-B, and Zephyr can be read by attackers with physical access due to a logic error, leading to local information disclosure without requiring additional privileges or user interaction. This vulnerability affects multiple embedded and IoT platforms where the preloader executes before operating system initialization. No patch is currently available for this issue.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity.
Parameters are not validated or sanitized, and are later used in various internal operations. Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Zephyr's Bluetooth Low Energy connection-response handler fails to verify that a connection request was actually initiated, relying only on identifier matching, so an attacker positioned within BLE radio range can inject unsolicited connection responses against affected devices. Successful exploitation corrupts connection state, yielding high integrity and availability impact with no confidentiality impact (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, CWE-358). Publicly available exploit code exists, but there is no evidence of active exploitation and EPSS is low at roughly 0.04% (11th percentile); the vendor advisory GHSA-xqj6-vh76-2vv8 is the authoritative reference.
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
In DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Zephyr's Bluetooth LE controller leaks a retained RX node when the Connected Isochronous Stream (CIS) Create control procedure is aborted through its "invalid PDU received" path, giving a radio-range attacker a denial-of-service primitive against affected devices. Any build with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is affected if it is mid-CIS-Create: against a peripheral the attacker sends a valid LL_CIS_REQ and then any unrelated LL Control PDU (for example LL_VERSION_IND) before the Host replies, while against a central a malicious peripheral simply answers LL_CIS_REQ with LL_UNKNOWN_RSP. In default builds the retained-node assertion fires immediately and produces a controller fatal error and usually a system reset from a single injected PDU; with CONFIG_BT_CTLR_ASSERT_DEBUG disabled, repeated connect-attack-reconnect cycles permanently drain the small LL notification pool until allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults, with recovery requiring a reboot. Only availability is impacted - the leaked node is orphaned and never reused or double-freed - and no public exploit identified at time of analysis. Exploitation requires the attacker to be within Bluetooth LE radio range of an unauthenticated, unencrypted ACL link; no pairing, encryption, or user interaction is needed.
System-wide denial of service can be triggered on Zephyr RTOS v4.4.0 or later builds for RISC-V Espressif SoCs (in-tree, the ESP32-C6 HPCORE) when CONFIG_USERSPACE is enabled: a local user-mode thread that has been granted the I2S device (PR:L) can issue a single i2s_trigger() call naming a direction the devicetree does not describe, causing a NULL pointer dereference in kernel mode (CWE-476). The impact is availability only-a NULL read with no attacker-controlled offset, no write primitive, and no information disclosure-but the default fatal-error handler halts the system, so an enabled user-mode thread can effect a system-wide denial of service. No public exploit code identified at time of analysis, and this is not confirmed actively exploited; real-world exposure is narrow because Xtensa Espressif targets do not support Zephyr userspace, ESP32-C5 does not select CONFIG_RISCV_PMP by default, and non-userspace builds can only pass the bad direction from trusted in-kernel code.
An out-of-bounds memory read in the Zephyr RTOS zbus proxy agent IPC backend allows a peer domain that already controls its own firmware - typically a second core on the same SoC - to leak a small amount of adjacent memory into the receiving domain's log output. The flaw is a non-NUL-terminated channel_name[] array being printed with a plain %s conversion on the frame-rejection error path; it is only reachable when CONFIG_ZBUS_PROXY_AGENT_IPC is built and logging is at warning level or higher (the default). Impact is bounded to limited information disclosure (CVSS 3.4, AV:L/PR:H, C:L/A:L) and a possible fatal fault if the scan leaves a mapped region; there is no public exploit identified at time of analysis and no confirmed active exploitation.
Predictable TCP initial sequence numbers in Zephyr RTOS allow off-path attackers to defeat RFC 6528 spoofing protection and perform blind TCP connection spoofing, data injection, or connection resets, but only on devices where the cryptographic random source fails exactly when the ISN secret key is first generated at boot. The flaw is a discarded return value from sys_csrand_get() that latches the 'key already generated' guard even on failure, leaving a 128-bit secret as all zeros for the entire boot; exploitation additionally requires the attacker to observe at least one ISN off-path and the spoofed peer to trust source addresses, and no public exploit was identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8), reflecting an unauthenticated remote issue whose high attack complexity and conditional preconditions keep it moderate rather than critical, and the signals converge on a conditional, moderate-severity issue rather than a top priority.
An out-of-bounds stack write in the Zephyr RTOS Goodix GT9xx touch driver (drivers/input/input_gt911.c) lets a malicious or misbehaving I2C touch controller overwrite up to 112 bytes of the gt911_process() stack frame with attacker-chosen data running at kernel privilege, potentially hijacking control flow on the host microcontroller. Only systems built with the GT9xx driver are affected, and reaching the defect requires physical/local access to the I2C bus (AV:P) - there is no network, USB, or syscall path - most plausibly on boards where the panel is a pluggable display module or shield rather than a soldered part. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the fix is a small one-line clamp and the same overflow can occur non-adversarially with a GT9271-class panel or a single corrupted status byte.
Out-of-bounds read of up to roughly 64 KiB in Zephyr's ITE IT8xxx2 SHI host-command backend allows an attacker who drives the SPI host controller to disclose adjacent embedded-controller SRAM to the host, or to fault the controller by reading past the end of SRAM. The root cause is a race: the 8-byte host-command header is copied from the SPI Rx FIFO directly into the shared in_msg buffer before the protocol version and derived packet length are validated, so a second transaction carrying data_len = 0xFFFF can deposit its header into a buffer that verify_rx() has already accepted; if those bytes land before the host-command thread assigns args.input_buf_size = rx_header->data_len, a registered handler is handed a 65535-byte length over a 256-byte buffer. Exploitation requires local control of the inter-processor SHI bus (a compromised host OS driving chip select and clock, or physical access to the SPI lines) plus a timing race the host can retry indefinitely, and is unauthenticated per the CVSS vector (PR:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Local user-mode threads in Zephyr RTOS builds that enable CONFIG_USERSPACE and CONFIG_SMBUS can invoke the smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() syscalls with an arbitrary pointer, silently unregistering SMBALERT or Host Notify callbacks that supervisor-mode code registered and thereby disabling alert handling system-wide; the same pointer can also be probed for valid kernel addresses because the syscall returns 0 on a hit versus -ENOENT on a miss. Exploitation is authenticated and local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, 4.4), requiring a user-mode thread that has already been granted the SMBus device object, and is limited to configurations using the Intel PCH SMBus driver with CONFIG_SMBUS_INTEL_PCH_SMBALERT or CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or the STM32 SMBus driver with CONFIG_SMBUS_STM32_SMBALERT; builds with CONFIG_ASSERT=y additionally turn a bogus pointer into a supervisor-mode fault and fatal system error, leaking which addresses are mapped. There is no impact on builds without CONFIG_USERSPACE or without an SMBus driver supporting SMBALERT/Host Notify, and no public exploit identified at time of analysis.
An out-of-bounds read in the Zephyr RTOS CoAP link-format helper match_path_uri() (subsys/net/lib/coap/coap_link_format.c) allows an unauthenticated remote attacker to drive the URI comparison loop one or more bytes past the end of a Uri-Query href= option value by sending a GET /.well-known/core?href=/<prefix> request whose value is a strict prefix of a longer registered resource path. Only devices running the Zephyr CoAP server subsystem with CONFIG_COAP_SERVER_WELL_KNOWN_CORE enabled (the default) and at least one resource declaring struct coap_core_metadata attributes reach the vulnerable code path. The over-read is bounded - in practice a single byte, limited by the compared path length - reads only uninitialized stack tail rather than receive-buffer or attacker-controlled data, cannot influence the response, and yields undefined behaviour rather than information disclosure or a matching error; no public exploit code was identified at time of analysis, and the assessed severity is Low (CVSS 3.7).
Denial of service in the Zephyr ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) lets a Wi-Fi-adjacent, unauthenticated attacker fault the device or permanently stop Wi-Fi reception in Zephyr builds (assessed range 4.2.0 through 4.4.1) that run an ESP co-processor over SPI with CONFIG_NANOPB_ENABLE_MALLOC selected. The driver takes a 16-bit TLV data_length straight off the wire and passes it to pb_istream_from_buffer() without validating it against the frame length, so pb_decode() can read roughly 62 KB past a 3188-byte stack object (CWE-125); the underlying half-duplex SPI aliasing bug lets the attacker steer the parser onto misaligned protobuf continuation bytes by getting the first fragment of a fragmented control response dropped mid-transmit, and the AP scan list the attacker can grow is the most convenient lever. Impact is limited to availability (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.3) with no disclosure or code execution; the high attack complexity reflects the timing race, no public exploit code identified at time of analysis, and the vendor has published a fix.
Concurrent writes to the same Internal Trusted Storage (ITS) UID in Zephyr RTOS can be encrypted with a duplicate AEAD nonce, because the default nonce provider secure_storage_its_transform_aead_get_nonce() keeps its counter in unsynchronized function-local statics (no lock). Affected are builds using the PSA ITS secure-storage transform with AES-GCM or ChaCha20-Poly1305, an application that writes the same UID from two threads at once, and one of the shipped log-structured back-ends (zms.c or the settings/NVS store) whose deferred garbage collection leaves both racing ciphertexts resident in the raw partition. The impact is cryptographic rather than direct code execution: nonce reuse under the same derived key leaks the XOR of the two plaintexts (potentially PSA persistent keys stored in ITS) and, for GCM, exposes the authentication key, allowing forgery of stored entries - but only for an adversary with local read access to the raw backing flash, and only where the same UID is written concurrently. CVSS is 5.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N), no CISA KEV listing, and no public exploit identified at time of analysis; risk is heavily gated by the narrow race window and the per-UID key salting that makes cross-UID collisions harmless. An upstream fix commit that serializes the provider with a mutex is available.
An out-of-bounds write of up to 895 bytes into static (.bss) memory can be triggered in Zephyr RTOS's Intel SEDI IPM driver (drivers/ipm/ipm_sedi.c) when the peer processor sets a doorbell payload length larger than the 128-byte incoming_data_buf. The vulnerable path is reachable when an application has registered an IPM receive callback via ipm_register_callback(), the driver's normal mode of use, and requires a local, highly privileged attacker (CVSS PR:H) with host-side ISH driver-level or raw BAR access to the device's memory-mapped register window, plus a production image built without CONFIG_DEBUG so the HAL's DBG_CHECK length guard is compiled away. The result is kernel data-structure corruption and a crash primitive - the overflow clobbers the driver context's k_sem and k_mutex and adjacent static data - but the flaw is platform-specific and locally scoped, so it is a moderate, defense-in-depth-relevant issue rather than an urgent internet-facing emergency; no public exploit identified at time of analysis, and an upstream fix commit is available.
A double-free (CWE-415) in Zephyr's experimental USB host stack lets a malicious or malformed USB peripheral crash the device: the stack frees the per-device configuration-descriptor buffer udev->cfg_desc on three error paths in usbh_device_set_configuration() but never clears the pointer, so the guarded cleanup in usbh_device_free() frees the same chunk again. Only builds with CONFIG_USB_HOST_STACK enabled are exposed, and because that stack is experimental and off by default most Zephyr deployments are unaffected; exploitation requires physical access to plug in the attacker-controlled device and, on v4.1.0-v4.3.x, a device-initiated removal or duplicate-connect event after a failed enumeration. With the default CONFIG_SYS_HEAP_HARDENING_BASIC the double free is caught and triggers k_panic() - a deterministic denial of service - while builds using CONFIG_SYS_HEAP_HARDENING_NONE or older releases corrupt the free list of the small 1024-byte usb_device_heap instead. No public exploit identified at time of analysis and no CISA KEV listing; the vendor has published a fix (commit d46a8c1f) and a GitHub security advisory, making this a genuine but low-priority issue given the physical-access and build-configuration prerequisites.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
An out-of-bounds read in Zephyr RTOS's gPTP (IEEE 802.1AS) announce-qualification routine lets an unauthenticated attacker with layer-2 adjacency to a vulnerable device send a single crafted Announce frame that drives the stack about 2 KB past the end of the received network buffer, potentially faulting the networking RX thread and causing a denial of service. The flaw affects only builds that enable the opt-in, experimental CONFIG_NET_GPTP option used in TSN/AVB deployments (Zephyr 1.13.0 up to before 4.4.2 per EUVD); default configurations are not vulnerable, and because gPTP frames go to a non-routed link-local multicast address, internet or routed exploitation is not possible. The impact is bounded by the assessed CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and no public exploit has been identified at time of analysis.
An out-of-bounds read in the Zephyr RTOS gPTP (IEEE 802.1AS) Ethernet layer lets an attacker on the same link crash-free but silently expose memory contents: a truncated Ethernet frame with ethertype 0x88F7 and fewer than 34 bytes of payload is accepted by gptp_handle_msg(), which dereferences a gPTP header pointer that extends past the received data and then retains the short packet for later state-machine parsing. Affected are Zephyr releases from 1.13.0 up to (but not including) 4.4.2 built with CONFIG_NET_GPTP on an interface configured as a gPTP port; no authentication or user interaction is required (PR:N/UI:N), though exploitation is limited by the adjacent-only vector and the requirement for a link that can deliver sub-minimum frames (for example the native_sim TAP driver or a MAC that accepts undersized frames). The impact is read-only and low (CVSS 3.1 base 3.1, C:L/I:N/A:N): under the default fixed-size buffer allocator only stale recycled buffer contents within the 128-byte fragment are disclosed, while a genuine out-of-bounds read requires the experimental CONFIG_NET_BUF_VARIABLE_DATA_SIZE allocator. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; an upstream fix commit and vendor advisory are available.
Heap memory exhaustion in Zephyr RTOS mcumgr SMP settings handlers allows unauthenticated attackers to trigger a monotonic heap leak by sending settings read, write, or delete commands that the application access hook rejects, ultimately depleting the kernel heap until the device must be rebooted. The three affected handlers - settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c - allocate buffers via k_malloc() but execute a direct return bypassing the end: cleanup label whenever CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK rejects a request via MGMT_CB_ERROR_RC. The vulnerability is availability-only with no memory corruption or information disclosure; no public exploit code or CISA KEV listing exists at time of analysis.
Type confusion in the Sierra Wireless HL78xx GNSS driver within Zephyr RTOS (4.4.0-4.4.1) allows an adjacent, unauthenticated attacker with GNSS signal-spoofing capability to drive the kernel-side NMEA parser into writing satellite data through a wild/garbage pointer, most likely crashing the device. The root defect is a struct member ordering invariant violation: the generic NMEA0183 match helper casts user_data directly to struct gnss_nmea0183_match_data, but hl78xx_gnss_data placed match_data as the second member (after const struct device), causing GGA/RMC callbacks to write fix data at wrong offsets and the GSV satellite callback to dereference a pointer constructed from non-pointer bytes. No public exploit exists; a vendor-released patch is available in Zephyr 4.4.2.
Bluetooth Classic L2CAP channel state confusion in Zephyr RTOS (versions 1.6.0 through pre-4.4.2) enables an adjacent unauthenticated peer to inject data PDUs into half-open L2CAP channels before configuration or security handshaking completes, forcing processing on stale or uninitialized channel fields. In the worst case, reused channel objects expose dangling _sdu reassembly buffer pointers, creating a memory-safety condition that causes channel and link teardown (denial of service) alongside unintended delivery of attacker-controlled data to upper-layer protocol handlers. No public exploit has been identified and the flaw is absent from CISA KEV; a vendor-released fix is available via Zephyr commit 2738ee9, targeting release 4.4.2.
TX packet pool exhaustion in Zephyr RTOS's IPv6 Neighbor Solicitation path allows an adjacent unauthenticated attacker to render a device permanently unable to transmit any network traffic. The leak in net_ipv6_send_ns() (subsys/net/ip/ipv6_nbr.c) occurs when an NS is already outstanding for a neighbor - each subsequent outbound packet during the ~3-second INCOMPLETE resolution window allocates a new net_pkt that is never released, silently consuming the fixed-size TX pool. With CONFIG_NET_PKT_TX_COUNT defaulting to as low as 4, a brief low-rate spoofed-source burst suffices to produce a complete, reboot-required network denial of service; no public exploit or active exploitation has been identified at time of analysis.
Ethernet bridge input processing in Zephyr RTOS leaks RX packet buffers when CONFIG_NET_ETHERNET_BRIDGE is enabled, allowing any adjacent L2 attacker to exhaust the fixed-size RX pool through a broadcast flood and halt all network reception until reboot. The root cause is eth_bridge_handle_locally() returning NET_OK without consuming the packet, so ethernet_recv() never frees the buffer. An unauthenticated attacker on the same Ethernet segment can emit broadcast or multicast frames with arbitrary EtherType values to permanently consume CONFIG_NET_PKT_RX_COUNT buffers one by one. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV.
Off-by-one out-of-bounds write in Zephyr RTOS's LwM2M JSON formatter allows a LwM2M server peer to corrupt one byte of memory adjacent to a STRING resource buffer by sending a WRITE payload whose string length exactly equals the buffer size. Affected devices are Zephyr LwM2M clients with the JSON content formatter enabled (cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*). The overflow deterministically writes a NUL byte past the buffer boundary, enabling potential crash or silent data corruption depending on memory layout; no public exploit has been identified at time of analysis, but the fix commit and security advisory are publicly visible.
Race condition in Zephyr RTOS's I3C IBI workqueue subsystem allows a physically-present attacker controlling an I3C peripheral to corrupt kernel memory structures, most realistically causing denial of service. The unsynchronized free-list (sys_slist_t) shared between ISR context and the workqueue handler thread creates a window where a work node can be handed to two consumers simultaneously or a garbage pointer can be dereferenced in a memcpy, producing an out-of-bounds write. No public exploit code has been identified and no CISA KEV listing exists; the patch wrapping all free-list operations in a k_spinlock is confirmed in upstream commit e87e7e2.
Use-after-free and double-free memory corruption in the Silicon Labs SiWx917 WiFi driver for Zephyr RTOS enables an adjacent unauthenticated attacker to corrupt the kernel networking buffer pool and crash the device. The driver's siwx91x_send() incorrectly releases a net_pkt owned by the L2 ethernet stack, causing use-after-free reads and a double-free when the caller accesses and unrefs the same packet; under concurrent network load, the trailing unref corrupts a live packet's reference count drawn from the recycled slab slot. No public exploit has been identified at time of analysis, but the vulnerable code path is compiled in by default and is exercisable via ordinary WiFi traffic that any adjacent-network peer can induce.
Zephyr RTOS's WireGuard subsystem incorrectly bypasses Poly1305 authentication for keepalive packets, allowing a network attacker to spoof VPN connection status events on affected embedded devices. The flaw in `wg_process_data_message()` accepted any 16-byte type-4 transport-data message and returned before invoking `wg_decrypt_packet()`, meaning the Poly1305 MAC was never verified - only a cleartext receiver-index lookup and a non-cryptographic expiry check were performed. Exploitation is constrained to integrity spoofing of the `NET_EVENT_VPN_CONNECTED` management signal; no traffic injection, key disclosure, or session takeover is possible, and no public exploit has been identified at time of analysis.
Zephyr RTOS's WireGuard VPN receive handler in wg_process_data_message() commits permanent peer-state mutations - endpoint roaming update, liveness timer refresh, and keypair promotion - before validating the anti-replay counter, allowing an on-path attacker who captures a single valid encrypted datagram to replay it from a spoofed source address and hijack the tunnel endpoint. Because AEAD decryption succeeds for any authentic ciphertext regardless of freshness, the spoofed replay is processed as legitimate and irreversibly alters peer state before the replay check fires and returns -EINVAL. No public exploit has been identified at time of analysis; patch is available via upstream commit 260c32ef.
Out-of-bounds read and in-object write in the Zephyr RTOS IEEE 1588 PTP stack affects all Zephyr versions with CONFIG_PTP enabled, exploitable by any unauthenticated attacker with Layer 2 adjacency. The PTP_MGMT_TIME management-id case in tlv_mgmt_post_recv() omits the length guard present for every sibling case, allowing a crafted short TLV to drive an 8-byte over-read and bounded write-back within the same struct ptp_msg allocation. No public exploit has been identified at time of analysis, and impact is constrained to minor adjacent-memory disclosure and corruption of the device's parsed management timestamp - no crash or past-allocation corruption is reachable.
Out-of-bounds read in Zephyr RTOS's LoRaWAN TS004 Fragmented Data Block Transport handler allows a party holding valid device session keys to trigger a bounded overread of up to 232 bytes beyond the 255-byte `MacCtx.RxPayload` static buffer, with overread data silently written into decoder buffers and the FUOTA flash image rather than returned to the attacker. The vulnerable function `frag_transport_package_callback()` in `subsys/lorawan/services/frag_transport.c` casts `rx_buf + rx_pos` to fixed-size structs and passes the pointer to the fragment decoder without first verifying that sufficient payload bytes remain. No public exploit is identified and this CVE is not listed in the CISA KEV catalog; CVSS 3.1 rates the vulnerability 3.1 (Low), reflecting the high-privilege access barrier and constrained, non-disclosing impact.
Out-of-bounds read in Zephyr RTOS's LoRaWAN clock synchronization service allows a malicious or compromised LoRaWAN application server to corrupt the target device's internal time offset by sending a crafted short AppTimeAns frame. The over-read is bounded by a 255-byte static backing buffer so no crash occurs, and the stray bytes are never transmitted back to the attacker, eliminating any information disclosure. Impact is confined to a minor, device-local clock integrity issue - the device's time estimate may silently diverge if a garbage time-correction value happens to match the pending token. No public exploit identified at time of analysis, and no CISA KEV listing.
Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.
NULL pointer dereference in the Zephyr RTOS OCPP 1.6 client allows a malicious or compromised OCPP central system - or a man-in-the-middle on an unencrypted ws:// connection - to remotely crash the OCPP reader thread of an EV charge point by returning a malformed CALLRESULT uid field. Impact is availability-only and platform-conditional: on MMU/MPU-equipped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION-enabled Zephyr targets, the fault invokes the fatal handler and produces a remote denial of service; on bare-metal targets where address 0 is readable, the call returns 0 and is benign. No public exploit is identified at time of analysis, and the vendor-supplied patch at the referenced commits is known to be incomplete - a second unguarded strtok_r/atoi pair in the same function path remains exploitable via a uid containing one token but no second hyphen-delimited segment.
Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.
Out-of-bounds write in Zephyr RTOS's ext2 filesystem driver enables supervisor-mode memory corruption when a device mounts a crafted ext2 image from a physical storage medium such as an SD card. The driver's superblock validation function omits bounds-checking the s_log_block_size field, allowing an attacker-controlled value to produce an inflated block size that silently misconfigures the kernel memory slab allocator beyond its static backing buffer, with impact ranging from denial of service to potential code execution in kernel mode. No confirmed active exploitation or public POC is identified at time of analysis; a vendor patch is available as upstream commit f270f4bd0e59585da31e1fbaa79c5abf73f1364b.
Zephyr RTOS's Hearing Access Service (HAS) GATT peripheral crashes when a previously bonded Bluetooth peer reconnects during a boot-time race window before bt_has_register() completes service initialization. The security_changed() callback - registered unconditionally via BT_CONN_CB_DEFINE - fires against NULL attribute pointers, triggering either a kernel assertion or a NULL dereference in bt_gatt_is_subscribed(). With CVSS AV:A/AC:H and confirmed DoS-only impact, this represents a medium-severity availability risk against embedded hearing-aid devices running Zephyr 3.6.0 through 4.4.1; no public exploit code has been identified, and a vendor patch is confirmed at 4.4.2.
Zephyr RTOS versions 4.3.0 through 4.4.1 leak 8 bytes of uninitialised kernel stack memory per MIDI 2.0 discovery request through the UMP Stream responder library. Two reply-packet builder functions declare their result struct without zero-initialisation, causing stale stack contents in the trailing two 32-bit words to be transmitted verbatim over the wire. The default unauthenticated Network MIDI 2.0 UDP endpoint exposes this to any remote peer; the request is freely repeatable, enabling accumulation of stack disclosures. No public exploit has been identified at time of analysis, and KEV status is absent.
Kernel memory disclosure and denial-of-service in Zephyr RTOS's mbox_send() syscall verifier stem from a time-of-check/time-of-use (TOCTOU) race in z_vrfy_mbox_send() (drivers/mbox/mbox_handlers.c), present in versions 3.0.0 through 4.4.2 on CONFIG_USERSPACE builds. An unprivileged userspace thread can race a second thread in the same address space to replace the validated msg->data pointer with a supervisor-mode address after the bounds check completes, causing the underlying driver to perform a supervisor-context read from an attacker-chosen kernel address. The upstream fix (commit ab35eacc) is confirmed available; no public exploit is identified at time of analysis.
Permanent Wi-Fi denial-of-service in the Infineon AIROC driver shipped with Zephyr RTOS 3.6.0 through 4.4.1 allows a Wi-Fi-adjacent attacker to exhaust a fixed 20-buffer transmit/receive pool by inducing repeated synchronous WHD send failures, each of which leaks one buffer from airoc_pool without releasing it. Once the pool is fully exhausted, both transmit and WHD-driven receive paths fail, severing all Wi-Fi connectivity until the device is physically rebooted. No active exploitation is recorded in CISA KEV and no public exploit code has been identified, but the defect can also manifest organically over a device's operational lifetime through ordinary transient failures.
Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.
Out-of-bounds stack read and write in the WNC-M14A2A LTE-M modem driver (wncm14a2a.c) within Zephyr RTOS versions 1.13.0 through below 4.4.2 allows a rogue cellular base station or RF attacker to crash the modem RX thread and leak adjacent stack memory without any application interaction. The defect fires automatically on receipt of an unsolicited %NOTIFYEV: event whose payload exceeds 39 bytes and lacks a quote character within the linearized region, causing scanning loop indices to walk past the fixed 40-byte stack buffer. While the write primitive is weakly controlled — limiting demonstrated impact to denial of service and stack disclosure — the CVE is tagged RCE by reporters, though the description explicitly states memory-safe code execution has not been demonstrated. No public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds read in Zephyr RTOS's 6LoWPAN IPHC uncompression layer allows any unauthenticated attacker on the same IEEE 802.15.4 radio link to crash the receiving device by transmitting a single malformed frame. The flaw resides in get_ihpc_inlined_size() (subsys/net/ip/6lo.c), where a 4-bit index derived directly from the received IPHC dispatch word can reach values 13-15, all beyond the 13-entry da_inline_size_table, producing an out-of-bounds read that corrupts the computed inline size and subsequently underflows a size_t difference. No public exploit or CISA KEV listing exists at time of analysis; the fix is confirmed upstream.
Interrupt-storm livelock in Zephyr RTOS's ARM PL011 UART driver (versions 1.14.0 through 4.4.1) allows an attacker controlling the serial peer to permanently hang the CPU by injecting line errors that trigger an error interrupt the ISR never clears. The root cause is that pl011_isr() acknowledged only the CTS modem-status interrupt and never wrote the UARTICR register for error bits (framing, parity, break, overrun), leaving the interrupt line permanently asserted and causing the CPU to re-enter the ISR indefinitely. Exploitation is gated by a non-default configuration requirement - the error interrupt path is off by default and no in-tree Zephyr subsystem enables it - so only embedded applications explicitly calling uart_irq_err_enable() on a PL011 interrupt-driven port are at risk. No public exploit or CISA KEV listing exists at time of analysis.
Infinite loop denial of service in the Zephyr RTOS Bluetooth GATT client allows an unauthenticated adjacent attacker to permanently hang the Bluetooth host processing thread by sending a crafted ATT Read By Type Response with a zero-length stride value during standard descriptor discovery. Affected targets - which span all Zephyr versions per the wildcard CPE - face a hung BT subsystem and likely a watchdog reset on constrained embedded hardware, rendering Bluetooth functionality inoperative. No public exploit code or CISA KEV listing exists at time of analysis, but the upstream commit diff publicly discloses the exact offending code path, substantially lowering the barrier to exploit development.
Out-of-bounds write in Zephyr RTOS's llext subsystem allows a local attacker with low privileges to corrupt supervisor-context memory by loading a crafted relocatable ELF extension on Xtensa targets. The vulnerability in llext_link_plt() (subsys/llext/llext_link.c) occurs before any extension code executes - at link time - meaning sandbox protections are bypassed entirely. Exploitation complexity is high (CVSS AC:H) due to constraints on the write value, no public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to deployments using llext on Xtensa architecture.
Concurrent TLS handshakes on Zephyr RTOS devices built with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE cause a deterministic kernel panic and device reset via a NULL pointer dereference in the uninitialized credential mutex wait queue. The PSA Protected Storage credential backend in all affected Zephyr builds declared its serialization mutex without proper initialization, leaving its dlist sentinels as NULL; the fault triggers only on first contention but is fully deterministic once two threads race to acquire the lock. No public exploit has been identified and the issue is not in CISA KEV, though no exploit sophistication is required beyond opening multiple simultaneous TLS connections.
Kernel information disclosure and local denial of service affect Zephyr RTOS on Intel ALH-equipped hardware through an unvalidated stream_id parameter in the Intel ALH digital-audio-interface driver. A local user-mode thread holding explicit ALH device-object access can invoke the dai_get_properties_copy() syscall with an arbitrary stream_id, triggering an out-of-bounds read from the fixed 64-entry alh_handshake_map[] array and leaking one byte of kernel memory per call, along with a computed FIFO register address that can expose kernel address-space layout. No public exploit has been identified at time of analysis; exploitation is constrained to systems built with CONFIG_USERSPACE and where device-object access has been deliberately granted to untrusted threads.
Out-of-bounds heap write in Zephyr RTOS's USB device-next CDC NCM class handler allows any physical USB host to corrupt the device's shared network buffer pool by issuing standard GET_NTB_PARAMETERS or GET_NTB_INPUT_SIZE control requests with a wLength field smaller than the response structure size. The overflow is bounded at up to 27 bytes and writes only fixed device constants, making its primary impact denial of service of the USB stack rather than arbitrary code execution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, exploitation requires only physical USB access to a device built with the opt-in device_next stack and CDC NCM class.
NULL pointer dereference in Zephyr RTOS's experimental device_next USB DFU class crashes any device where DFU download is enabled when a USB host sends a zero-length DFU_DNLOAD terminator after initiating a valid transfer. The result is a fatal CPU fault causing device crash or reset - impact is strictly limited to availability, with the vendor and commit diff explicitly confirming no memory corruption or information disclosure. No public exploit has been identified at time of analysis, and exploitation requires physical control of the attached USB host.
Double-free (CWE-415) and use-after-free read (CWE-416) vulnerabilities in the Realtek BEE Bluetooth HCI driver within Zephyr RTOS expose affected devices to memory pool corruption and likely crashes when an adjacent Bluetooth peer drives heavy transmit activity toward resource-exhaustion error conditions. The bt_hci_bee_send() function in hci_bee.c violated the bt_hci_driver_api buffer-ownership contract by routing all error exits through a shared cleanup label that unconditionally called net_buf_unref(), while the Zephyr host TX path also unrefs the buffer on error return - resulting in a double free of the same net_buf and a subsequent read of freed memory via a LOG_ERR call compiled in at the default error log level. An upstream fix is confirmed via Zephyr project commit 9a684b5c314fb1d8670b01f7b6c4450a9353906c; no formally released patched version has been independently confirmed, and no public exploit has been identified at the time of this analysis.
Uninitialized-memory and out-of-bounds read in the UpdateHub OTA client of Zephyr RTOS allows a malicious or on-path UpdateHub server to crash the device update thread via a crafted probe response, producing a network-triggerable denial of service. The flaw exists in z_impl_updatehub_probe() within subsys/mgmt/updatehub/updatehub.c, where metadata_copy is allocated with k_malloc (leaving heap unzeroed) and filled via memcpy without a NUL terminator; a subsequent strlen() then scans into uninitialized heap, producing an over-long length fed to json_obj_parse(). No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but it is remotely triggerable against Zephyr devices running UpdateHub without DTLS transport protection.
Out-of-bounds memory read and write in the Zephyr RTOS SF32LB MPI QSPI NOR flash driver allows a low-privileged thread, when explicitly granted flash device access in a CONFIG_USERSPACE build, to disclose arbitrary CPU-addressable memory or corrupt flash and invalidate cache beyond the mapped flash window. The root cause is a signed/unsigned type confusion in the offset bounds check: a crafted negative off_t value converts to a large unsigned integer and the subsequent addition wraps to a small result that passes the check, allowing memcpy to read from or program flash at attacker-controlled addresses. No public exploit code has been identified at time of analysis; exploitation is nonetheless mechanically straightforward for any attacker familiar with signed/unsigned integer confusion vulnerabilities.
Use-after-free in Zephyr RTOS kernel queue peek operations (z_impl_k_queue_peek_head and z_impl_k_queue_peek_tail in kernel/queue.c) allows a local low-privileged thread to obtain a dangling pointer to freed heap memory by winning a race against a concurrent k_queue_get call on a shared queue. Successful exploitation - requiring SMP or preemptive concurrency - can leak a stale heap pointer or crash the system when the returned dangling pointer is subsequently consumed as a live buffer in the net_buf, Bluetooth, USB, or networking subsystems. No public exploit exists and no active exploitation is confirmed; CVSS scores this at 3.6 (Low), accurately reflecting the narrow race window and local-only attack surface.
Use-after-free in Zephyr RTOS 4.4.0's Bluetooth ATT host layer (subsys/bluetooth/host/att.c) allows an adjacent unauthenticated peer to crash the Bluetooth host or potentially corrupt live memory by disconnecting while an ATT PDU is in-flight. The tx_meta_data_storage[] array retains a dangling att_chan pointer after L2CAP tears down and frees the channel slab slot, and the deferred att_tx_destroy_work_handler running on the system workqueue dereferences that freed pointer. No pairing or special privileges are required - a routine ATT connection is sufficient to reach the vulnerable code path. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
PSA Crypto key slot exhaustion in Zephyr's Bluetooth Mesh subnet.c permanently leaks one key slot on every subnet key teardown when CONFIG_BT_MESH_PRIV_BEACONS is enabled (the default). Devices running Zephyr 3.6.0 through 4.4.x are affected: a provisioner or network administrator with the node's device key can trigger the leak via Config Server NetKey Delete, Key Refresh Procedure, or reprovisioning over the Bluetooth Mesh network. With the default pool of 16 PSA key slots, roughly a dozen such operations exhaust the pool, preventing subnet creation and potentially starving other on-device PSA consumers until a reboot. No public exploit or CISA KEV listing exists; real-world impact is constrained by the high-privilege and proximity requirements.
Out-of-bounds read in Zephyr RTOS DHCPv4 client (versions 1.7.0 through 4.4.x) allows an adjacent-network attacker to crash the DHCP client or leak adjacent pointer contents by sending a crafted DHCP reply with a message-type value greater than 8. The defect is a classic sizeof-vs-ARRAY_SIZE confusion: the bounds guard compares a raw msg_type byte against the byte-size of a pointer array (32 or 64, depending on architecture) rather than its element count of 8, so values 9-31/63 bypass the check and cause a wild-pointer dereference inside a debug log call. Exploitation is gated on a non-default build configuration (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), substantially reducing the real-world attack surface. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Bluetooth GATT notification and indication paths in Zephyr RTOS 2.6.0 through 4.4.x skip the application-configured encryption, authentication, and LESC security requirements for characteristic values when the application follows the documented idiom of passing the Characteristic Declaration attribute to the notify/indicate APIs. A remote Bluetooth peer within radio range can connect without pairing and trigger the server to emit protected characteristic values over an unsecured link by writing the Client Characteristic Configuration descriptor, achieving an access-control bypass and information disclosure. No public exploit is identified at time of analysis; exploitation requires adjacent network access and specific application configuration.
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
Denial of service in Zephyr's Synopsys DesignWare I2C driver (slave mode) enables an I2C master on the same physical bus to cause permanent failure of the write_requested() callback due to a missing START_DET interrupt enable. This halts all subsequent write transactions and desynchronizes higher-layer framing until device reset. No public exploit identified; patch available from vendor.
Denial of service in Zephyr RTOS versions before 4.5.0 occurs when mounting a crafted ext2 filesystem with zero values in superblock fields s_blocks_per_group or s_inodes_per_group. An attacker with physical access via removable media can trigger a division-by-zero fault on ARM Cortex-M targets, causing a system crash. No other impact beyond availability; no active exploitation or public exploit is known.
Divide-by-zero in Zephyr's DesignWare SPI driver exposes kernel crash to locally-authorized userspace threads on all releases through v4.4.0. The spi_transceive syscall verify handler in spi_handlers.c copies the caller-supplied spi_config from userspace without validating the frequency field, allowing a thread with SPI device object access to pass frequency=0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(), which raises a CPU exception on Cortex-M Mainline and ARC platforms and halts the system. No public exploit has been identified at time of analysis; exploitation is gated behind a non-default build configuration and explicit privilege grant.
Kernel heap exhaustion in Zephyr RTOS affects all builds with CONFIG_USERSPACE enabled from v1.12.0 through v4.4.1, allowing any low-privilege user thread to permanently leak kernel memory by supplying a forged object handle to k_poll(). The z_vrfy_k_poll() syscall verifier allocates a kernel-side event copy but, prior to the fix, killed the calling thread via K_OOPS without freeing that buffer - a path any user thread can trigger repeatedly. By spawning additional threads that inherit the parent's resource_pool, an attacker can multiply the leak rate until the shared kernel heap is depleted, causing system-wide denial of service affecting queues, message buffers, and all future k_poll calls. No public exploit code or CISA KEV listing has been identified at time of analysis.
Zephyr RTOS Bluetooth Mesh PB-ADV provisioning can be permanently denied on any affected device within BLE advertising range by an unauthenticated remote attacker exploiting a timer-reset logic flaw in subsys/bluetooth/mesh/pb_adv.c. The watchdog timer governing protocol timeouts was rescheduled unconditionally before validity checks, allowing an attacker to hold a dead provisioning link open indefinitely by sending FCS-valid PDUs faster than the 60-120 second timeout interval. The device's unprovisioned beacon is suppressed and all new Link Open requests are rejected for as long as the attacker transmits, rendering the device permanently un-provisionable without a reboot. No public exploit is identified and the vulnerability is not listed in CISA KEV, though the attack requires no authentication and low complexity to execute from within BLE range.
Persistent denial of service in the NXP LPUART serial driver for Zephyr RTOS allows an unprivileged userspace thread to deterministically crash the entire embedded system by issuing a uart_configure() call with an unsupported parameter value while CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled. The driver's configure path calls LPUART_Deinit() before validating the requested configuration, gating the peripheral clock; if validation then rejects the parameters, the clock is never restored, and any subsequent LPUART register access - from any thread or interrupt handler - triggers a hard fault and system reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fault path is trivially and deterministically reproducible from userspace on affected NXP MCU targets.
NULL pointer dereference in Zephyr RTOS's syscall verifier allows an unprivileged user-mode thread to crash the kernel across the userspace security boundary. The z_vrfy_k_thread_name_copy() verification handler in kernel/thread.c incorrectly guards against the caller-supplied thread pointer being NULL rather than the ko pointer returned by k_object_find(), so any non-NULL but unregistered address bypasses the check and triggers a supervisor-mode NULL dereference that halts or reboots the system. Affecting Zephyr v2.0.0 through v4.4.0 when built with CONFIG_USERSPACE and CONFIG_THREAD_NAME enabled, no public exploit code and no CISA KEV listing have been identified at time of analysis, but the one-syscall reproducibility makes this straightforward to trigger in qualifying builds.
Denial of service in Zephyr RTOS's Nuvoton NuMaker HSUSBD USB device-controller driver allows a physical or adjacent USB host to permanently wedge the device's USB control endpoint. The driver unconditionally arms the control Data IN stage without accounting for the hardware's inability to disarm an already-armed transfer, so a host that cancels an in-flight control transfer and then re-issues a SETUP packet drives the driver out of sync. Repeated cancel-and-re-SETUP cycles cause the control endpoint to NAK every subsequent transfer, rendering the USB function non-operational until a USB reset or re-plug. No public exploit identified at time of analysis.
Out-of-bounds stack write in Zephyr's nRF70 Wi-Fi driver exposes embedded systems to memory corruption when the nRF70 co-processor returns a power-save event with more than eight TWT flow entries. The vulnerable function `nrf_wifi_event_proc_get_power_save_info()` blindly copies co-processor-supplied TWT entries into a fixed 8-element stack array without validating `num_twt_flows` against `WIFI_MAX_TWT_FLOWS`, enabling heap/stack corruption of approximately 40 bytes per excess entry. No public exploit code exists and the flaw is not listed in CISA KEV, but the adjacent-network attack vector and the indirect over-the-air influence path via a rogue AP manipulating TWT sessions make this a meaningful risk in Wi-Fi 6 (802.11ax) deployment environments running Zephyr with `CONFIG_NRF70_STA_MODE`.
Use-after-free and double-free in Zephyr RTOS's experimental USB host stack (CONFIG_USB_HOST_STACK, introduced in v4.4.0) allows an attacker with physical USB access to crash the target device or corrupt live kernel slab objects by bouncing a USB device connection to trigger a second removal event after the slab has already been freed. The flaw exists because usbh_device_disconnect() frees the root usb_device slab object without clearing the cached ctx->root pointer, and UHC controller drivers (uhc_max3421e, uhc_mcux_common) emit UHC_EVT_DEV_REMOVED directly from hardware line-state with no debounce or re-entry guard. No public exploit identified at time of analysis, and no CISA KEV listing; the physical-access prerequisite substantially constrains the realistic attacker population.
Kernel denial-of-service in Zephyr RTOS v4.4.0's Dhara flash translation layer driver crashes the system during FTL disk initialization when a flash error coincides with the journal-resume checkpoint scan. The driver's dhara_nand_read/erase/prog/copy callbacks unconditionally dereference the caller-supplied err pointer, but the upstream Dhara library legitimately passes NULL during its binary search in find_last_checkblock(), triggering a NULL write and kernel fault. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog; exploitation is gated on specific flash media conditions (uncorrectable ECC, bad block, or induced fault) occurring on a checkpoint page at mount time, constraining real-world risk to physical or supply-chain threat models.
Out-of-bounds read in Zephyr RTOS's mDNS detection logic crashes devices resolving short-suffix hostnames when CONFIG_MDNS_RESOLVER is compiled in. The flaw in dns_resolve_name_internal() reads a fixed 7 bytes from a suffix pointer regardless of the actual string length, causing a 1-2 byte over-read past the NUL terminator for suffixes like .org, .com, .net, or .io. Under the specific runtime condition of a tightly-sized allocation adjacent to an unmapped boundary (guard page, MPU domain, or ASAN), the over-read faults and crashes the device; no public exploit has been identified at time of analysis and CVSS 3.7 with AC:H accurately reflects the narrow crash preconditions.
NULL pointer dereference in the Zephyr RTOS MAX32xxx USB device controller driver (udc_max32.c) crashes devices running Zephyr v4.4.0 when a physically connected USB host aborts an in-flight EP0 control transfer by sending a new SETUP packet - a completely legal USB protocol action. The race condition between interrupt-queued transfer-completion events and asynchronous FIFO draining by the driver thread causes net_buf_add(NULL, ...) when udc_buf_get() returns NULL on an empty FIFO, producing a near-NULL pointer dereference and device fault. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis; real-world risk is constrained by the physical access prerequisite and the specific MAX32xxx hardware dependency.
Use-after-free in Zephyr's asynchronous SNTP client (sntp_close_async, v4.2.0-v4.4.0) can be triggered remotely by any network peer or off-path attacker capable of dropping or delaying UDP NTP responses, exploiting a race between the system workqueue thread and the socket-service poll thread. The most probable outcome is a crash of the networking subsystem thread (denial of service); where the freed net_context pool slot is rapidly reallocated, memory corruption is possible. The vulnerability is on the normal SNTP timeout path, making it reliably and periodically triggerable when NET_CONFIG_SNTP_INIT_RESYNC is enabled. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition in Zephyr RTOS Bluetooth Classic RFCOMM host stack (v4.4.0 and earlier) permanently wedges session state and exhausts the fixed bt_rfcomm_pool when a peer-transmitted DISC frame for dlci 0 collides with a simultaneous local-initiated teardown. The underlying L2CAP channel is never released and the session slot is never reclaimed, eventually denying RFCOMM service to the targeted peer across repeated occurrences. No public exploit identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) with AV:A/AC:H accurately reflects both the Bluetooth adjacency prerequisite and the high-complexity timing race required.
Denial of service in Zephyr RTOS v4.4.0 allows an attacker with access to a serial, UART, or shell-console interface to crash an affected embedded device by exhausting the MCUmgr shared buffer pool and triggering a NULL pointer dereference. The defect in mcumgr_serial_process_frag() (CWE-476) was introduced during the MCUmgr rework and manifests in default builds where assertion checks are compiled out, making the write-through-NULL a hard fault rather than a caught assertion. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but exploitation is straightforward for any attacker with interface access.
Forged IPv6 Neighbor Discovery acceptance in the Zephyr RTOS network stack (all releases through v4.4.0) lets an adjacent on-link attacker inject spoofed Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages because an operator-precedence bug in subsys/net/ip/ipv6_nbr.c silently skips every RFC 4861 sanity check whenever the (always-present) ICMPv6 code is 0. Because the bypassed checks include the Hop-Limit==255 on-link proof, even off-link/remote attackers may have forged ND packets accepted, enabling default-router/DNS/SLAAC hijacking and neighbor-cache poisoning for man-in-the-middle, redirection, and denial of service. A vendor patch exists (commit 095f064c) but there is no public exploit identified at time of analysis and the issue is not in CISA KEV.
USB CDC-NCM network driver in Zephyr RTOS through v4.4.0 permanently deadlocks the shared network egress thread when a USB bus suspend coincides with outbound device traffic, requiring a reboot to recover. The defect in `cdc_ncm_send()` ignores the return value of `usbd_ep_enqueue()` and unconditionally blocks on a completion semaphore that only the (never-fired) bulk-IN ISR can signal - halting not just CDC-NCM traffic but all egress on other interfaces sharing the TX thread. No public exploit code or active exploitation has been identified; the trigger is routine USB host power management, making this an availability risk for any embedded Zephyr device using USB virtual Ethernet.
NULL pointer dereference in the Zephyr Bluetooth LE Audio Basic Audio Profile unicast client crashes devices running Zephyr v4.3.0 and v4.4.0 (and earlier) when connected to a malicious or buggy remote ASCS server. The handler unicast_client_ep_qos_state() writes attacker-controlled QoS fields through stream->qos without verifying the pointer is non-NULL - a condition that legitimately exists during the window between bt_bap_stream_config() and unicast_group_add_stream(). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but CVSS adjacency (AV:A) and no-auth (PR:N) make it exploitable by any device within Bluetooth LE radio range acting as a rogue ASCS server.
Out-of-bounds write in Zephyr RTOS's Microchip SERCOM-G1 UART driver (introduced in v4.4.0) allows an adjacent attacker who can send serial data to corrupt one byte of memory immediately beyond the caller-supplied RX buffer, potentially causing a crash or denial of service. The flaw exists only when CONFIG_UART_MCHP_ASYNC is enabled (non-default on in-tree PIC32CM-JH board configs) and the consuming application calls uart_rx_enable() with a one-byte buffer - a narrow but real embedded firmware scenario. No exploit code is publicly available and this vulnerability is not listed in CISA KEV; the upstream fix has been committed but a tagged patched release version has not been independently confirmed.
Infinite-loop denial of service in the Zephyr RTOS PL011 UART driver (v4.1.0-v4.4.0) permanently stalls any thread that calls uart_irq_tx_enable() - including the Bluetooth HCI H4 send path - when CTS hardware flow control is enabled and the wired peer withholds CTS during transmission. The root cause is a software workaround loop (CWE-835) that compensates for the PL011 controller's level-transition TX interrupt behavior but never exits when pl011_fifo_fill() returns 0 due to a blocked CTS line. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; exploitation requires physical or hardware-adjacent control of the UART CTS pin, materially constraining real-world risk.
Use-after-free in Zephyr RTOS's ICMPv4 echo handler allows any unauthenticated remote host to trigger memory corruption or a crash by sending a standard ICMP ping to an affected device. The defect exists in all versions from v1.14 (2019) through v4.4.0, where `icmpv4_handle_echo_request()` reads from a freed `net_pkt` struct after transferring packet ownership to the TX path - violating a contract explicitly documented in `net_core.c`. No public exploit code exists and this CVE does not appear in CISA KEV, but the zero-privilege, network-reachable attack surface makes it a meaningful risk for internet-exposed embedded and IoT deployments running Zephyr with ICMP statistics enabled.
Use-after-free in Zephyr's IPv4 IGMP implementation (igmp_send(), subsys/net/ip/igmp.c) allows a remote unauthenticated attacker to trigger undefined behavior and sporadic denial-of-service crashes on devices running Zephyr v2.6.0 through v4.4.0. The flaw arises because the network packet's interface pointer is re-read via net_pkt_iface(pkt) after net_send_data() may have already released the packet's last reference, returning the slab block to the free list. No public exploit code exists and the vulnerability is not in CISA KEV; however, the remote trigger path via IGMP membership queries (224.0.0.1) requires no authentication, and the analogous IPv6 MLD path (mld_send) carries the same unpatched pattern.
Use-after-free in Zephyr RTOS v4.4.0 on Xtensa/MMU targets allows privileged kernel code to corrupt page tables or trigger a fatal MMU exception by destroying a memory domain without unlinking it from the global xtensa_domain_list. The dangling list node persists after arch_mem_domain_deinit() sets domain->arch.ptables to NULL, so any subsequent arch_mem_map() or arch_mem_unmap() call traverses the stale entry and dereferences the freed pointer - producing at minimum a denial-of-service kernel crash (NULL pointer deref) and at worst page-table memory corruption that undermines userspace process isolation. No public exploit code exists and no CISA KEV listing is present; however the integrity and availability impact (I:H, A:H) in a real-time OS kernel elevates practical severity beyond the 6.3 base score for affected embedded deployments.
Use-after-free in Zephyr RTOS's native TCP2 stack allows a concurrent connection teardown - triggered by ordinary TCP traffic from an adjacent-network peer - to invalidate a cached iterator pointer in net_tcp_foreach(), crashing the system or causing the iterator callback to operate on attacker-influenced reallocated memory. All Zephyr releases from the TCP2 stack introduction in 2020 through v4.4.0 (inclusive) are affected. No public exploit has been identified at time of analysis and no CISA KEV listing exists; the primary real-world risk is denial of service against embedded or IoT devices with TCP networking and shell access exposed on an adjacent network segment.
Integer underflow in Zephyr RTOS Bluetooth Mesh solicitation handling (versions ≤ 4.3.0) allows any physically proximate, unauthenticated BLE device to corrupt memory via a crafted advertising PDU, potentially causing denial of service or arbitrary code execution on the target device. The flaw resides in bt_mesh_sol_recv() within the OD Private Proxy Server feature and requires no prior pairing or device association to trigger. No public exploit has been identified at time of analysis and EPSS probability is low at 0.02%, but the combination of zero-interaction exploitation and RCE impact on embedded IoT devices warrants prioritization where this configuration is deployed.
Zephyr RTOS sockets created with IPPROTO_TLS_1_3 can negotiate TLS 1.2 connections when both TLS versions are enabled in Kconfig, because socket-level protocol selection is not propagated to mbedTLS's minimum version enforcement. Applications explicitly requesting TLS 1.3 may silently fall back to TLS 1.2, exposing them to known TLS 1.2 weaknesses such as POODLE or truncation attacks. Remote unauthenticated attackers can exploit this via network-level protocol downgrade during the TLS handshake.
Device unique identifiers in the preloader of Openwrt, Android, Yocto, RDK-B, and Zephyr can be read by attackers with physical access due to a logic error, leading to local information disclosure without requiring additional privileges or user interaction. This vulnerability affects multiple embedded and IoT platforms where the preloader executes before operating system initialization. No patch is currently available for this issue.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity.
Parameters are not validated or sanitized, and are later used in various internal operations. Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Zephyr's Bluetooth Low Energy connection-response handler fails to verify that a connection request was actually initiated, relying only on identifier matching, so an attacker positioned within BLE radio range can inject unsolicited connection responses against affected devices. Successful exploitation corrupts connection state, yielding high integrity and availability impact with no confidentiality impact (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, CWE-358). Publicly available exploit code exists, but there is no evidence of active exploitation and EPSS is low at roughly 0.04% (11th percentile); the vendor advisory GHSA-xqj6-vh76-2vv8 is the authoritative reference.
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
In DA, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.