Technology · Zephyr Project
Zephyr Project Zephyr vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 95 vulnerabilities in Zephyr Project Zephyr: 5 in the last 7 days and 40 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126957, was published on 12 November 2026. 10 vulnerabilities in the last four weeks, down 23% on the four before (13).
- Last 7 days
- 5
- Last 90 days
- 40
- Critical, all time
- 3
- Exploited in the wild
- 0
About Zephyr Project Zephyr
Zephyr is a real-time operating system for resource-constrained embedded systems.
Latest Zephyr Project Zephyr vulnerabilities
- CVE-2026-126957: Zephyr ICMP integer underflow in IPv4 option handlingmediumCVSS 5.3
- CVE-2026-90834: Zephyr UART wide-data syscall verifier NULL pointer dereferencemediumCVSS 5.5
- CVE-2026-90833: Zephyr RTOS simulated EEPROM driver integer overflow in range validationhighCVSS 7.8
- CVE-2026-87042: Zephyr PTP port unvalidated logMessageInterval denial of servicemediumCVSS 6.5
- CVE-2026-82391: Zephyr HTTP server HTTP/2 buffer overflow via static file servingcriticalCVSS 9.1
- CVE-2026-87043: Zephyr entropy-device uninitialized read in random number generationmediumCVSS 4.8
- CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()highCVSS 8.8
- CVE-2026-82961: Zephyr GPIO syscall pin validation bypasshighCVSS 7.8
- CVE-2026-19741: Zephyr OpenThread hardcoded default joiner credentialhighCVSS 7.5
- CVE-2026-19947: Zephyr device multiplexer privilege escalation in devmuxmediumCVSS 5.3
- CVE-2026-19595: Zephyr RTIO syscall memory validation bypassmediumCVSS 6.1
- CVE-2026-19673: Zephyr RTOS ethernet_recv buffer length validation bypasshighCVSS 7.1EPSS 0.3%
- CVE-2026-19940: Zephyr RTOS Bluetooth HFP AG work queue memory corruptionmediumCVSS 6.5EPSS 0.2%
- CVE-2026-19939: Zephyr AVDTP timeout corruption in A2DP session disconnectmediumCVSS 6.3EPSS 0.2%
- CVE-2026-19936: Zephyr Bluetooth Mesh delayable message queue race conditionmediumCVSS 4.8EPSS 0.1%
- CVE-2026-19935: Zephyr Bluetooth LE L2CAP use-after-free on dynamic channel teardownhighCVSS 7.5EPSS 0.2%
- CVE-2026-19577: Zephyr RTOS IPv6 routing out-of-bounds read in neighbor resolutionhighCVSS 7.1EPSS 0.2%
- CVE-2026-19574: Zephyr ARM64 MMU ASID allocation collision in memory domain isolationhighCVSS 7EPSS 0.1%
- CVE-2026-19569: Zephyr kernel integer overflow in dynamic object allocationhighCVSS 8.8EPSS 0.1%
- CVE-2026-15894: Zephyr Bluetooth Mesh stack buffer overflow in solicitation handlerhighCVSS 8.8
- CVE-2026-18746: Zephyr LwM2M parse_write_op null pointer dereference in block handlingmediumCVSS 5.9
- CVE-2026-18413: NXP MCUX LPADC driver buffer overflow in ADC samplinghighCVSS 7.8
- CVE-2026-16513: Zephyr RTIO userspace verifier write-what-where in rtio_sqe_copy_in_get_handles()highCVSS 7.8
- CVE-2026-15890: Zephyr PSA Trusted Storage AEAD nonce reuse in concurrent writesmediumCVSS 5.3EPSS 0.1%
- CVE-2026-17050: Zephyr RTOS USB host stack double-free in configuration descriptormediumCVSS 5.7EPSS 0.2%
Most severe Zephyr Project Zephyr vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-13214: Zephyr OCPP client stack buffer overflow in GetConfiguration handlercriticalCVSS 9.8EPSS 0.5%
- CVE-2026-5067: Zephyr RTOS stack overflow in HTTP server WebSocket upgradecriticalCVSS 9.8
- CVE-2026-82391: Zephyr HTTP server HTTP/2 buffer overflow via static file servingcriticalCVSS 9.1
- CVE-2026-12366: Zephyr use-after-free in dynamic k_timer cleanuphighCVSS 8.8EPSS 0.2%
- CVE-2026-9771: Zephyr RTOS flash_copy() privilege escalation via unvalidated device pointershighCVSS 8.8EPSS 0.1%
- CVE-2026-19569: Zephyr kernel integer overflow in dynamic object allocationhighCVSS 8.8EPSS 0.1%
- CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()highCVSS 8.8
- CVE-2026-15894: Zephyr Bluetooth Mesh stack buffer overflow in solicitation handlerhighCVSS 8.8
- CVE-2026-10643: Zephyr RTOS heap overflow in IP socket recvmsg implementationhighCVSS 8.7
- CVE-2026-8718: Zephyr DTLS Connection ID buffer overflow in getsockopthighCVSS 8.4EPSS 0.2%
Vulnerabilities per week
10 vulnerabilities in the last four weeks, down 23% on the four before (13). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 8 | 1 | |
| 31 Aug 2026 | 2 | 0 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 3 | 0 | |
| 21 Sep 2026 | 2 | 0 | |
| 28 Sep 2026 | 3 | 0 | |
| 5 Oct 2026 | 5 | 0 | |
| 12 Oct 2026 | 4 | 0 | |
| 19 Oct 2026 | 3 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 2 | 0 | |
| 9 Nov 2026 | 5 | 1 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Zephyr Project Zephyr vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/zephyr)<a href="https://junglewise.ai/threats/technologies/zephyr"><img src="https://junglewise.ai/threats/technologies/zephyr/badge.svg" alt="Zephyr Project Zephyr vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/zephyr.json, and this page as text at https://junglewise.ai/threats/technologies/zephyr.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Zephyr Project Zephyr vulnerabilities", https://junglewise.ai/threats/technologies/zephyr, 13 November 2026.