# Zephyr RTOS vulnerabilities Source: https://junglewise.ai/threats/technologies/rtos Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/rtos.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 25 vulnerabilities in Zephyr RTOS: 3 in the last 7 days and 23 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77685, was published on 10 November 2026. 11 vulnerabilities in the last four weeks, up 10% on the four before (10). ## Counts - Last 7 days: 3 - Last 30 days: 11 - Last 90 days: 23 - All time: 25 (0 critical, 0 exploited in the wild) ## About Zephyr RTOS Real-time operating system for embedded and IoT devices. ## Latest Zephyr RTOS vulnerabilities - [CVE-2026-77685: Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys) (high, CVSS 8.3, published 10 Nov 2026) - [CVE-2026-90586: Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread) (high, CVSS 7.8, published 9 Nov 2026) - [CVE-2026-87045: Zephyr HTTP/2 server NULL pointer dereference in stream binding](https://junglewise.ai/threats/cve-2026-87045-the-http-2-server-in-subsys-net-lib-http-http-server-http2-c) (high, CVSS 7.5, published 6 Nov 2026) - [CVE-2026-87041: Zephyr RTIO submission-queue verifier memory access bypass](https://junglewise.ai/threats/cve-2026-87041-the-rtio-submission-queue-verifier-rtio-vrfy-sqe-in-subsys-rtio) (high, CVSS 7.8, published 4 Nov 2026) - [CVE-2026-87038: Zephyr i3c_transfer TOCTOU privilege escalation](https://junglewise.ai/threats/cve-2026-87038-the-user-mode-verification-handler-for-the-i3c-transfer-system) (high, CVSS 7, published 4 Nov 2026) - [CVE-2026-85036: Zephyr Bluetooth Classic AVDTP memory corruption in work queue](https://junglewise.ai/threats/cve-2026-85036-the-bluetooth-classic-avdtp-layer-defers-releasing-a-session-s) (medium, CVSS 5.7, published 4 Nov 2026) - [CVE-2026-82962: Zephyr ethernet_fill_header() out-of-bounds write via routing](https://junglewise.ai/threats/cve-2026-82962-ethernet-fill-header-in-subsys-net-l2-ethernet-ethernet-c-can) (medium, CVSS 6.5, published 28 Oct 2026) - [CVE-2026-79982: Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack) (high, CVSS 8.8, published 23 Oct 2026) - [CVE-2026-19676: Zephyr RTOS PECI driver privilege escalation in peci_transfer()](https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy) (high, CVSS 7.8, published 21 Oct 2026) - [CVE-2026-77684: Zephyr Bluetooth Classic Hands-Free Profile buffer leak](https://junglewise.ai/threats/cve-2026-77684-the-bluetooth-classic-hands-free-profile-hf-role-in-subsys) (medium, CVSS 5.7, published 19 Oct 2026) - [CVE-2026-76788: Zephyr OSDP Control Panel stack buffer overflow in reply parser](https://junglewise.ai/threats/cve-2026-76788-the-osdp-control-panel-reply-parser-cp-decode-response-in-subsys) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-19938: Zephyr Bluetooth host ATT buffer use-after-free in signed write path](https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does) (medium, CVSS 5.9, published 13 Oct 2026) - [CVE-2026-19937: Zephyr Bluetooth Mesh Access layer delayable message context leak](https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in) (medium, CVSS 5.7, published 13 Oct 2026) - [CVE-2026-19740: Zephyr Bluetooth LE Controller LLCP receive node leak](https://junglewise.ai/threats/cve-2026-19740-the-link-layer-control-procedure-llcp-implementation-of-the) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-19735: Zephyr TCP ISN derivation with all-zero key on entropy failure](https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net) (medium, CVSS 4.8, published 11 Oct 2026) - [CVE-2026-19669: Zephyr fuel gauge syscall stack buffer overflow](https://junglewise.ai/threats/cve-2026-19669-the-user-mode-syscall-verifiers-z-vrfy-fuel-gauge-get-props-and-z) (high, CVSS 7.8, published 11 Oct 2026) - [CVE-2026-19570: Zephyr LE Audio Broadcast Sink buffer overflow in BAP metadata](https://junglewise.ai/threats/cve-2026-19570-the-le-audio-broadcast-sink-in-subsys-bluetooth-audio-bap) (high, CVSS 8.8, published 9 Oct 2026) - [CVE-2026-19186: Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption](https://junglewise.ai/threats/cve-2026-19186-ieee802154-decipher-data-frame-in-subsys-net-l2-ieee802154) (high, CVSS 8.1, published 7 Oct 2026) - [CVE-2026-19185: Zephyr RTOS i3c_do_ccc() memory validation bypass](https://junglewise.ai/threats/cve-2026-19185-the-system-call-verifier-for-i3c-do-ccc-in-drivers-i3c-i3c) (high, CVSS 7.8, published 5 Oct 2026) - [CVE-2026-19184: NXP GAU ADC driver buffer overflow in adc_mcux_gau_adc](https://junglewise.ai/threats/cve-2026-19184-the-nxp-gau-adc-driver-drivers-adc-adc-mcux-gau-adc-c-validated) (high, CVSS 8.4, published 5 Oct 2026) - [CVE-2026-18415: Zephyr IEEE 802.15.4 buffer overflow in ieee802154_send()](https://junglewise.ai/threats/cve-2026-18415-ieee802154-send-in-subsys-net-l2-ieee802154-ieee802154-c-copies) (medium, CVSS 6.3, published 28 Sep 2026) - [CVE-2026-17052: Zephyr RTOS Time-aware GPIO syscall memory write check bypass](https://junglewise.ai/threats/cve-2026-17052-the-time-aware-gpio-syscall-verification-handler-z-vrfy-tgpio-pin) (high, CVSS 7.8, published 21 Sep 2026) - [CVE-2026-15924: Zephyr TLS socket layer race condition in session cache](https://junglewise.ai/threats/cve-2026-15924-zephyr-tls-socket-layer-race-condition-in-session-cache) (medium, CVSS 5.9, published 14 Sep 2026) - [CVE-2026-11812: Zephyr UpdateHub management state corruption and denial of service](https://junglewise.ai/threats/cve-2026-11812-zephyr-updatehub-management-state-corruption-and-denial-of) (low, CVSS 2.5, published 10 Aug 2026) - [CVE-2026-10848: Zephyr OCPP 1.6 client buffer over-read in RPC frame parsing](https://junglewise.ai/threats/cve-2026-10848-zephyr-ocpp-1-6-client-buffer-over-read-in-rpc-frame-parsing) (high, CVSS 7, published 2 Aug 2026) ## Most severe Zephyr RTOS vulnerabilities - [CVE-2026-19570: Zephyr LE Audio Broadcast Sink buffer overflow in BAP metadata](https://junglewise.ai/threats/cve-2026-19570-the-le-audio-broadcast-sink-in-subsys-bluetooth-audio-bap) (high, CVSS 8.8, published 9 Oct 2026) - [CVE-2026-79982: Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack) (high, CVSS 8.8, published 23 Oct 2026) - [CVE-2026-76788: Zephyr OSDP Control Panel stack buffer overflow in reply parser](https://junglewise.ai/threats/cve-2026-76788-the-osdp-control-panel-reply-parser-cp-decode-response-in-subsys) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-19184: NXP GAU ADC driver buffer overflow in adc_mcux_gau_adc](https://junglewise.ai/threats/cve-2026-19184-the-nxp-gau-adc-driver-drivers-adc-adc-mcux-gau-adc-c-validated) (high, CVSS 8.4, published 5 Oct 2026) - [CVE-2026-77685: Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys) (high, CVSS 8.3, published 10 Nov 2026) - [CVE-2026-19186: Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption](https://junglewise.ai/threats/cve-2026-19186-ieee802154-decipher-data-frame-in-subsys-net-l2-ieee802154) (high, CVSS 8.1, published 7 Oct 2026) - [CVE-2026-19669: Zephyr fuel gauge syscall stack buffer overflow](https://junglewise.ai/threats/cve-2026-19669-the-user-mode-syscall-verifiers-z-vrfy-fuel-gauge-get-props-and-z) (high, CVSS 7.8, published 11 Oct 2026) - [CVE-2026-17052: Zephyr RTOS Time-aware GPIO syscall memory write check bypass](https://junglewise.ai/threats/cve-2026-17052-the-time-aware-gpio-syscall-verification-handler-z-vrfy-tgpio-pin) (high, CVSS 7.8, published 21 Sep 2026) - [CVE-2026-90586: Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread) (high, CVSS 7.8, published 9 Nov 2026) - [CVE-2026-19185: Zephyr RTOS i3c_do_ccc() memory validation bypass](https://junglewise.ai/threats/cve-2026-19185-the-system-call-verifier-for-i3c-do-ccc-in-drivers-i3c-i3c) (high, CVSS 7.8, published 5 Oct 2026) ## Vulnerabilities per week 11 vulnerabilities in the last four weeks, up 10% on the four before (10). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 7 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 4 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 4 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Other Zephyr technologies - [Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-zephyr-os): 12 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Zephyr RTOS vulnerabilities", https://junglewise.ai/threats/technologies/rtos, 13 November 2026.