Zephyrproject Zephyr

Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem

Insufficient publish message length validation in MQTT

Packet length decoding error in MQTT

MQTT buffer overflow on receive buffer

UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array

Buffer overflow in Zephyr USB DFU DNLOAD

A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.

zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs (system sys_ring_buf_get() and sys_ring_buf_put).

Potential buffer overflow vulnerability in the Zephyr CANbus subsystem

Bluetooth HCI Error Handling Double Free

Possible read out of bounds in dns read

Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr

DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses

Unchecked user input length in the Zephyr WiFi shell module

Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

Improper Input Frame Validation in ieee802154 Processing

L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req()

Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

bt: host: Wrong key validation check

Unchecked user input length in the Zephyr Settings Shell

ipm: signed to unsigned conversion problem in esp32_ipm_send

fs: fuse: buffer overflow vulnerability in the Zephyr FS

can: out of bounds in remove_rx_filter function

dns: memory‑safety issue in the DNS name parser

Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem

DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer

Usb bluetooth device ACL read cb buffer overflow

DoS: Invalid Initialization in le_read_buffer_size_complete

arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y

Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

Out of bounds read in dns_copy_qname

Bluetooth characteristic LESC security requirement not enforced without additional flags

Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem

Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning

Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning

Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal

Buffer overflow in usb device class

Potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driver

RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr

Error handling invalid packet sequence