Zephyrproject

CVE	Summary	Severity	CVSS	EPSS	Priority
CVE-2026-13214	Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.	CRITICAL	9.8	0.5%	50
CVE-2026-13212	Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.	HIGH	8.8	0.2%	44
CVE-2026-12522	Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.	HIGH	8.8	0.2%	44
CVE-2026-9771	Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.	HIGH	8.8	0.1%	44
CVE-2026-12633	Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.	HIGH	8.1	0.2%	41
CVE-2026-15891	Null pointer dereference in Zephyr RTOS's MQTT-SN client subsystem allows a malicious or on-path network actor to crash any Zephyr device running an active MQTT-SN session by suppressing gateway keepalive responses. The defect is a missing assignment from the SYS_SLIST_PEEK_HEAD_CONTAINER macro in process_ping(): gw is never populated, remains NULL, and is subsequently dereferenced and passed to the memory slab allocator. The outcome is a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE) or silent slab free-list corruption on targets where address 0 is writable. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the trivial trigger condition and absence of MQTT-SN authentication make this straightforward for any party controlling or impersonating the client's gateway.	HIGH	7.5	0.3%	38
CVE-2026-13215	Out-of-bounds write in Zephyr RTOS's ext2 filesystem driver enables supervisor-mode memory corruption when a device mounts a crafted ext2 image from a physical storage medium such as an SD card. The driver's superblock validation function omits bounds-checking the s_log_block_size field, allowing an attacker-controlled value to produce an inflated block size that silently misconfigures the kernel memory slab allocator beyond its static backing buffer, with impact ranging from denial of service to potential code execution in kernel mode. No confirmed active exploitation or public POC is identified at time of analysis; a vendor patch is available as upstream commit f270f4bd0e59585da31e1fbaa79c5abf73f1364b.	MEDIUM	6.8	0.2%	34
CVE-2026-13734	Zephyr RTOS's WireGuard VPN receive handler in wg_process_data_message() commits permanent peer-state mutations - endpoint roaming update, liveness timer refresh, and keypair promotion - before validating the anti-replay counter, allowing an on-path attacker who captures a single valid encrypted datagram to replay it from a spoofed source address and hijack the tunnel endpoint. Because AEAD decryption succeeds for any authentic ciphertext regardless of freshness, the spoofed replay is processed as legitimate and irreversibly alters peer state before the replay check fires and returns -EINVAL. No public exploit has been identified at time of analysis; patch is available via upstream commit 260c32ef.	MEDIUM	6.5	0.2%	33
CVE-2026-14696	Ethernet bridge input processing in Zephyr RTOS leaks RX packet buffers when CONFIG_NET_ETHERNET_BRIDGE is enabled, allowing any adjacent L2 attacker to exhaust the fixed-size RX pool through a broadcast flood and halt all network reception until reboot. The root cause is eth_bridge_handle_locally() returning NET_OK without consuming the packet, so ethernet_recv() never frees the buffer. An unauthenticated attacker on the same Ethernet segment can emit broadcast or multicast frames with arbitrary EtherType values to permanently consume CONFIG_NET_PKT_RX_COUNT buffers one by one. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV.	MEDIUM	6.5	0.2%	33
CVE-2026-14697	TX packet pool exhaustion in Zephyr RTOS's IPv6 Neighbor Solicitation path allows an adjacent unauthenticated attacker to render a device permanently unable to transmit any network traffic. The leak in net_ipv6_send_ns() (subsys/net/ip/ipv6_nbr.c) occurs when an NS is already outstanding for a neighbor - each subsequent outbound packet during the ~3-second INCOMPLETE resolution window allocates a new net_pkt that is never released, silently consuming the fixed-size TX pool. With CONFIG_NET_PKT_TX_COUNT defaulting to as low as 4, a brief low-rate spoofed-source burst suffices to produce a complete, reboot-required network denial of service; no public exploit or active exploitation has been identified at time of analysis.	MEDIUM	6.5	0.2%	33
CVE-2026-14366	Use-after-free and double-free memory corruption in the Silicon Labs SiWx917 WiFi driver for Zephyr RTOS enables an adjacent unauthenticated attacker to corrupt the kernel networking buffer pool and crash the device. The driver's siwx91x_send() incorrectly releases a net_pkt owned by the L2 ethernet stack, causing use-after-free reads and a double-free when the caller accesses and unrefs the same packet; under concurrent network load, the trailing unref corrupts a live packet's reference count drawn from the recycled slab slot. No public exploit has been identified at time of analysis, but the vulnerable code path is compiled in by default and is exercisable via ordinary WiFi traffic that any adjacent-network peer can induce.	MEDIUM	6.4	0.2%	32
CVE-2026-9728	Kernel memory disclosure and denial-of-service in Zephyr RTOS's mbox_send() syscall verifier stem from a time-of-check/time-of-use (TOCTOU) race in z_vrfy_mbox_send() (drivers/mbox/mbox_handlers.c), present in versions 3.0.0 through 4.4.2 on CONFIG_USERSPACE builds. An unprivileged userspace thread can race a second thread in the same address space to replace the validated msg->data pointer with a supervisor-mode address after the bounds check completes, causing the underlying driver to perform a supervisor-context read from an attacker-chosen kernel address. The upstream fix (commit ab35eacc) is confirmed available; no public exploit is identified at time of analysis.	MEDIUM	6.4	0.1%	32
CVE-2026-13216	Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr::::::::) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.	MEDIUM	6.1	0.2%	31
CVE-2026-13217	NULL pointer dereference in the Zephyr RTOS OCPP 1.6 client allows a malicious or compromised OCPP central system - or a man-in-the-middle on an unencrypted ws:// connection - to remotely crash the OCPP reader thread of an EV charge point by returning a malformed CALLRESULT uid field. Impact is availability-only and platform-conditional: on MMU/MPU-equipped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION-enabled Zephyr targets, the fault invokes the fatal handler and produces a remote denial of service; on bare-metal targets where address 0 is readable, the call returns 0 and is benign. No public exploit is identified at time of analysis, and the vendor-supplied patch at the referenced commits is known to be incomplete - a second unguarded strtok_r/atoi pair in the same function path remains exploitable via a uid containing one token but no second hyphen-delimited segment.	MEDIUM	5.9	0.5%	30
CVE-2026-13478	Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.	MEDIUM	5.5	0.1%	28

CVE-2026-13214

Remote code execution and denial of service in the Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp) allows an attacker who controls or man-in-the-middles the central system endpoint to smash the OCPP reader thread's stack. A malicious GetConfiguration message with an over-long JSON "key" field triggers an unbounded strcpy() into a fixed 50-byte stack buffer, corrupting the reader thread's stack with attacker-chosen bytes. A vendor patch exists and no public exploit has been identified at time of analysis; CVSS is rated 9.8, though real-world reach is bounded by the OCPP-charging-station niche.

CRITICAL

9.8

0.5%

50

CVE-2026-13212

Control-flow hijack in the Zephyr RTOS virtio driver (versions 4.2.0 through pre-4.4.2) allows a malicious or compromised virtio backend - such as an untrusted hypervisor or an untrusted PCI/MMIO virtio device - to invoke an arbitrary function pointer inside the Zephyr guest's interrupt handler. The root cause is a missing bounds check in virtio_isr() (drivers/virtio/virtio_common.c): the 16-bit descriptor-chain head ID written by the device into the used ring is consumed directly as an index into heap-allocated recv_cbs[] and desc[] arrays, each sized exactly vq->num, enabling an out-of-bounds read that returns an attacker-shaped {function pointer, argument} pair which is then called. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive - arbitrary code execution in interrupt context triggered entirely from the backend - is high-severity and the vendor-confirmed patch is available in Zephyr 4.4.2.

HIGH

8.8

0.2%

44

CVE-2026-12522

Stack buffer overflow in Zephyr RTOS's HL7800 cellular modem driver exposes cellular-attached embedded devices to remote stack corruption during normal LTE network attach, with no device-side privileges or user interaction required. The flaw in on_cmd_atcmdinfo_ipaddr() allows a malicious or impersonated cellular network - for example via a rogue base station - to supply a crafted +CGCONTRDP response whose address fields, whose lengths are derived from attacker-controlled delimiter positions, are copied without bounds checking into fixed 64-byte and 16-byte stack buffers in supervisor context. Outcomes range from a remotely triggerable crash to potential control-flow hijacking on targets without stack canaries; no public exploit has been identified at time of analysis, and an upstream fix commit is available from the Zephyr project.

HIGH

8.8

0.2%

44

CVE-2026-9771

Local privilege escalation in Zephyr RTOS (versions 4.0.0-4.4.1 with CONFIG_USERSPACE enabled) allows an unprivileged user-mode thread to execute arbitrary code in kernel supervisor mode by supplying forged struct device pointers with attacker-controlled API function tables to the flash_copy() system call. The syscall verifier z_vrfy_flash_copy() validated the output buffer but omitted the K_SYSCALL_DRIVER_FLASH object validation for src_dev and dst_dev that every sibling flash syscall enforces - a unique gap in the trust boundary that the kernel implementation blindly dereferences in supervisor context. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is confirmed in commit 1b1ecdc4 and available in Zephyr 4.4.2.

HIGH

8.8

0.1%

44

CVE-2026-12633

Memory corruption in Zephyr RTOS's IPv6 neighbor discovery stack allows any unauthenticated host on the same network link to crash or corrupt kernel memory with a single crafted ICMPv6 Router Advertisement. The handle_ra_6co() function in subsys/net/ip/ipv6_nbr.c fails to bound the 8-bit context_len field from a 6LoWPAN Context Option to the RFC 6775 maximum of 128, triggering an unsigned size_t underflow that causes memset to overwrite an unbounded region of kernel memory. This produces a reliable adjacent-network denial of service with collateral memory integrity loss; no public exploit code has been identified at time of analysis, though the patch commit and security advisory are publicly available.

HIGH

8.1

0.2%

41

CVE-2026-15891

Null pointer dereference in Zephyr RTOS's MQTT-SN client subsystem allows a malicious or on-path network actor to crash any Zephyr device running an active MQTT-SN session by suppressing gateway keepalive responses. The defect is a missing assignment from the SYS_SLIST_PEEK_HEAD_CONTAINER macro in process_ping(): gw is never populated, remains NULL, and is subsequently dereferenced and passed to the memory slab allocator. The outcome is a kernel panic (with CONFIG_MEM_SLAB_POINTER_VALIDATE) or silent slab free-list corruption on targets where address 0 is writable. No public exploit has been identified at time of analysis, and no KEV listing exists; however, the trivial trigger condition and absence of MQTT-SN authentication make this straightforward for any party controlling or impersonating the client's gateway.

HIGH

7.5

0.3%

38

CVE-2026-13215

Out-of-bounds write in Zephyr RTOS's ext2 filesystem driver enables supervisor-mode memory corruption when a device mounts a crafted ext2 image from a physical storage medium such as an SD card. The driver's superblock validation function omits bounds-checking the s_log_block_size field, allowing an attacker-controlled value to produce an inflated block size that silently misconfigures the kernel memory slab allocator beyond its static backing buffer, with impact ranging from denial of service to potential code execution in kernel mode. No confirmed active exploitation or public POC is identified at time of analysis; a vendor patch is available as upstream commit f270f4bd0e59585da31e1fbaa79c5abf73f1364b.

MEDIUM

6.8

0.2%

34

CVE-2026-13734

Zephyr RTOS's WireGuard VPN receive handler in wg_process_data_message() commits permanent peer-state mutations - endpoint roaming update, liveness timer refresh, and keypair promotion - before validating the anti-replay counter, allowing an on-path attacker who captures a single valid encrypted datagram to replay it from a spoofed source address and hijack the tunnel endpoint. Because AEAD decryption succeeds for any authentic ciphertext regardless of freshness, the spoofed replay is processed as legitimate and irreversibly alters peer state before the replay check fires and returns -EINVAL. No public exploit has been identified at time of analysis; patch is available via upstream commit 260c32ef.

MEDIUM

6.5

0.2%

33

CVE-2026-14696

Ethernet bridge input processing in Zephyr RTOS leaks RX packet buffers when CONFIG_NET_ETHERNET_BRIDGE is enabled, allowing any adjacent L2 attacker to exhaust the fixed-size RX pool through a broadcast flood and halt all network reception until reboot. The root cause is eth_bridge_handle_locally() returning NET_OK without consuming the packet, so ethernet_recv() never frees the buffer. An unauthenticated attacker on the same Ethernet segment can emit broadcast or multicast frames with arbitrary EtherType values to permanently consume CONFIG_NET_PKT_RX_COUNT buffers one by one. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV.

MEDIUM

6.5

0.2%

33

CVE-2026-14697

TX packet pool exhaustion in Zephyr RTOS's IPv6 Neighbor Solicitation path allows an adjacent unauthenticated attacker to render a device permanently unable to transmit any network traffic. The leak in net_ipv6_send_ns() (subsys/net/ip/ipv6_nbr.c) occurs when an NS is already outstanding for a neighbor - each subsequent outbound packet during the ~3-second INCOMPLETE resolution window allocates a new net_pkt that is never released, silently consuming the fixed-size TX pool. With CONFIG_NET_PKT_TX_COUNT defaulting to as low as 4, a brief low-rate spoofed-source burst suffices to produce a complete, reboot-required network denial of service; no public exploit or active exploitation has been identified at time of analysis.

MEDIUM

6.5

0.2%

33

CVE-2026-14366

Use-after-free and double-free memory corruption in the Silicon Labs SiWx917 WiFi driver for Zephyr RTOS enables an adjacent unauthenticated attacker to corrupt the kernel networking buffer pool and crash the device. The driver's siwx91x_send() incorrectly releases a net_pkt owned by the L2 ethernet stack, causing use-after-free reads and a double-free when the caller accesses and unrefs the same packet; under concurrent network load, the trailing unref corrupts a live packet's reference count drawn from the recycled slab slot. No public exploit has been identified at time of analysis, but the vulnerable code path is compiled in by default and is exercisable via ordinary WiFi traffic that any adjacent-network peer can induce.

MEDIUM

6.4

0.2%

32

CVE-2026-9728

Kernel memory disclosure and denial-of-service in Zephyr RTOS's mbox_send() syscall verifier stem from a time-of-check/time-of-use (TOCTOU) race in z_vrfy_mbox_send() (drivers/mbox/mbox_handlers.c), present in versions 3.0.0 through 4.4.2 on CONFIG_USERSPACE builds. An unprivileged userspace thread can race a second thread in the same address space to replace the validated msg->data pointer with a supervisor-mode address after the bounds check completes, causing the underlying driver to perform a supervisor-context read from an attacker-chosen kernel address. The upstream fix (commit ab35eacc) is confirmed available; no public exploit is identified at time of analysis.

MEDIUM

6.4

0.1%

32

CVE-2026-13216

Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.

MEDIUM

6.1

0.2%

31

CVE-2026-13217

NULL pointer dereference in the Zephyr RTOS OCPP 1.6 client allows a malicious or compromised OCPP central system - or a man-in-the-middle on an unencrypted ws:// connection - to remotely crash the OCPP reader thread of an EV charge point by returning a malformed CALLRESULT uid field. Impact is availability-only and platform-conditional: on MMU/MPU-equipped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION-enabled Zephyr targets, the fault invokes the fatal handler and produces a remote denial of service; on bare-metal targets where address 0 is readable, the call returns 0 and is benign. No public exploit is identified at time of analysis, and the vendor-supplied patch at the referenced commits is known to be incomplete - a second unguarded strtok_r/atoi pair in the same function path remains exploitable via a uid containing one token but no second hyphen-delimited segment.

MEDIUM

5.9

0.5%

30

CVE-2026-13478

Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.

MEDIUM

5.5

0.1%

28

Severity Breakdown

Monthly CVE Trend

Affected Products (7)

Top Risky CVEs