Technology · Zephyr
Zephyr RTOS vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 25 vulnerabilities in Zephyr RTOS: 3 in the last 7 days and 23 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77685, was published on 10 November 2026. 11 vulnerabilities in the last four weeks, up 10% on the four before (10).
- Last 7 days
- 3
- Last 90 days
- 23
- Critical, all time
- 0
- Exploited in the wild
- 0
About Zephyr RTOS
Real-time operating system for embedded and IoT devices.
Latest Zephyr RTOS vulnerabilities
- CVE-2026-77685: Zephyr RFCOMM multiplexer buffer overflow and information disclosurehighCVSS 8.3
- CVE-2026-90586: Xtensa MMU uninitialized page-table pointer in userspace thread setuphighCVSS 7.8EPSS 0.1%
- CVE-2026-87045: Zephyr HTTP/2 server NULL pointer dereference in stream bindinghighCVSS 7.5
- CVE-2026-87041: Zephyr RTIO submission-queue verifier memory access bypasshighCVSS 7.8
- CVE-2026-87038: Zephyr i3c_transfer TOCTOU privilege escalationhighCVSS 7
- CVE-2026-85036: Zephyr Bluetooth Classic AVDTP memory corruption in work queuemediumCVSS 5.7
- CVE-2026-82962: Zephyr ethernet_fill_header() out-of-bounds write via routingmediumCVSS 6.5
- CVE-2026-79982: Zephyr Bluetooth HCI USB buffer overflow in controller-to-host pathhighCVSS 8.8
- CVE-2026-19676: Zephyr RTOS PECI driver privilege escalation in peci_transfer()highCVSS 7.8
- CVE-2026-77684: Zephyr Bluetooth Classic Hands-Free Profile buffer leakmediumCVSS 5.7
- CVE-2026-76788: Zephyr OSDP Control Panel stack buffer overflow in reply parserhighCVSS 8.8
- CVE-2026-19938: Zephyr Bluetooth host ATT buffer use-after-free in signed write pathmediumCVSS 5.9EPSS 0.2%
- CVE-2026-19937: Zephyr Bluetooth Mesh Access layer delayable message context leakmediumCVSS 5.7EPSS 0.2%
- CVE-2026-19740: Zephyr Bluetooth LE Controller LLCP receive node leakmediumCVSS 6.5EPSS 0.1%
- CVE-2026-19735: Zephyr TCP ISN derivation with all-zero key on entropy failuremediumCVSS 4.8EPSS 0.2%
- CVE-2026-19669: Zephyr fuel gauge syscall stack buffer overflowhighCVSS 7.8EPSS 0.1%
- CVE-2026-19570: Zephyr LE Audio Broadcast Sink buffer overflow in BAP metadatahighCVSS 8.8EPSS 0.3%
- CVE-2026-19186: Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryptionhighCVSS 8.1
- CVE-2026-19185: Zephyr RTOS i3c_do_ccc() memory validation bypasshighCVSS 7.8EPSS 0.1%
- CVE-2026-19184: NXP GAU ADC driver buffer overflow in adc_mcux_gau_adchighCVSS 8.4EPSS 0.1%
- CVE-2026-18415: Zephyr IEEE 802.15.4 buffer overflow in ieee802154_send()mediumCVSS 6.3
- CVE-2026-17052: Zephyr RTOS Time-aware GPIO syscall memory write check bypasshighCVSS 7.8EPSS 0.1%
- CVE-2026-15924: Zephyr TLS socket layer race condition in session cachemediumCVSS 5.9EPSS 0.3%
- CVE-2026-11812: Zephyr UpdateHub management state corruption and denial of servicelowCVSS 2.5EPSS 0.1%
- CVE-2026-10848: Zephyr OCPP 1.6 client buffer over-read in RPC frame parsinghighCVSS 7EPSS 0.4%
Most severe Zephyr RTOS vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-19570: Zephyr LE Audio Broadcast Sink buffer overflow in BAP metadatahighCVSS 8.8EPSS 0.3%
- CVE-2026-79982: Zephyr Bluetooth HCI USB buffer overflow in controller-to-host pathhighCVSS 8.8
- CVE-2026-76788: Zephyr OSDP Control Panel stack buffer overflow in reply parserhighCVSS 8.8
- CVE-2026-19184: NXP GAU ADC driver buffer overflow in adc_mcux_gau_adchighCVSS 8.4EPSS 0.1%
- CVE-2026-77685: Zephyr RFCOMM multiplexer buffer overflow and information disclosurehighCVSS 8.3
- CVE-2026-19186: Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryptionhighCVSS 8.1
- CVE-2026-19669: Zephyr fuel gauge syscall stack buffer overflowhighCVSS 7.8EPSS 0.1%
- CVE-2026-17052: Zephyr RTOS Time-aware GPIO syscall memory write check bypasshighCVSS 7.8EPSS 0.1%
- CVE-2026-90586: Xtensa MMU uninitialized page-table pointer in userspace thread setuphighCVSS 7.8EPSS 0.1%
- CVE-2026-19185: Zephyr RTOS i3c_do_ccc() memory validation bypasshighCVSS 7.8EPSS 0.1%
Vulnerabilities per week
11 vulnerabilities in the last four weeks, up 10% on the four before (10). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 7 | 0 | |
| 12 Oct 2026 | 2 | 0 | |
| 19 Oct 2026 | 4 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 4 | 0 | |
| 9 Nov 2026 | 2 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Zephyr RTOS vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/rtos)<a href="https://junglewise.ai/threats/technologies/rtos"><img src="https://junglewise.ai/threats/technologies/rtos/badge.svg" alt="Zephyr RTOS vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/rtos.json, and this page as text at https://junglewise.ai/threats/technologies/rtos.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Zephyr RTOS vulnerabilities", https://junglewise.ai/threats/technologies/rtos, 13 November 2026.