{"schema_version":1,"title":"Zephyr OS vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in Zephyr OS: 3 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-91007, was published on 12 November 2026. 7 vulnerabilities in the last four weeks, up 250% on the four before (2).","url":"https://junglewise.ai/threats/technologies/zephyr-zephyr-os","json_url":"https://junglewise.ai/threats/technologies/zephyr-zephyr-os.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/zephyr-zephyr-os","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":12,"critical":0,"exploited":0,"last_7_days":3,"last_30_days":10,"last_90_days":12,"last_365_days":12},"latest":[{"cve":"CVE-2026-91007","cvss":7.8,"slug":"cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in","title":"Zephyr charger driver kernel privilege escalation via user-mode syscall verification","severity":"high","exploited":false,"published_at":"2026-11-12T16:19:21.25+00:00","url":"https://junglewise.ai/threats/cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in"},{"cve":"CVE-2026-90589","cvss":5.5,"epss":0.001,"slug":"cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack","title":"Zephyr kernel thread stack memory leak via k_thread_abort","severity":"medium","exploited":false,"published_at":"2026-11-09T22:18:57.27+00:00","url":"https://junglewise.ai/threats/cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack"},{"cve":"CVE-2026-90587","cvss":4.6,"epss":0.0018,"slug":"cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a","title":"Zephyr USB host stack null pointer dereference in device enumeration","severity":"medium","exploited":false,"published_at":"2026-11-09T22:18:56.97+00:00","url":"https://junglewise.ai/threats/cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a"},{"cve":"CVE-2026-87044","cvss":6.5,"slug":"cve-2026-87044-the-mbed-tls-crypto-shim-driver-in-drivers-crypto-crypto-mbedtls","title":"Mbed TLS crypto shim driver heap exhaustion via unaborted PSA operations","severity":"medium","exploited":false,"published_at":"2026-11-04T06:17:07.313+00:00","url":"https://junglewise.ai/threats/cve-2026-87044-the-mbed-tls-crypto-shim-driver-in-drivers-crypto-crypto-mbedtls"},{"cve":"CVE-2026-87039","cvss":7.8,"slug":"cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers","title":"Zephyr I2S user-mode syscall verifier unvalidated pointer dereference","severity":"high","exploited":false,"published_at":"2026-11-04T06:17:06.623+00:00","url":"https://junglewise.ai/threats/cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers"},{"cve":"CVE-2026-85033","cvss":4.6,"slug":"cve-2026-85033-the-avrcp-target-role-in-subsys-bluetooth-host-classic-avrcp-c","title":"Zephyr AVRCP Target vendor response buffer leak on disconnection","severity":"medium","exploited":false,"published_at":"2026-11-03T14:17:38.933+00:00","url":"https://junglewise.ai/threats/cve-2026-85033-the-avrcp-target-role-in-subsys-bluetooth-host-classic-avrcp-c"},{"cve":"CVE-2026-82389","cvss":6.5,"slug":"cve-2026-82389-in-the-bluetooth-classic-hands-free-profile-audio-gateway-role","title":"Zephyr Bluetooth Classic HFP AG stack crash on RFCOMM connection failure","severity":"medium","exploited":false,"published_at":"2026-10-26T17:17:30.757+00:00","url":"https://junglewise.ai/threats/cve-2026-82389-in-the-bluetooth-classic-hands-free-profile-audio-gateway-role"},{"cve":"CVE-2026-82388","cvss":5.3,"slug":"cve-2026-82388-bt-hfp-hf-connect-in-subsys-bluetooth-host-classic-hfp-hf-c","title":"Zephyr HFP Hands-Free connection denial of service","severity":"medium","exploited":false,"published_at":"2026-10-26T17:17:30.62+00:00","url":"https://junglewise.ai/threats/cve-2026-82388-bt-hfp-hf-connect-in-subsys-bluetooth-host-classic-hfp-hf-c"},{"cve":"CVE-2026-81038","cvss":7.1,"slug":"cve-2026-81038-the-object-transfer-service-server-builds-its-object-action","title":"Zephyr Object Transfer Service OACP checksum uninitialized memory disclosure","severity":"high","exploited":false,"published_at":"2026-10-26T17:17:30.35+00:00","url":"https://junglewise.ai/threats/cve-2026-81038-the-object-transfer-service-server-builds-its-object-action"},{"cve":"CVE-2026-79981","cvss":6.5,"slug":"cve-2026-79981-the-dns-stub-resolver-in-subsys-net-lib-dns-resolve-c-binds-one","title":"Zephyr DNS resolver predictable source port and transaction ID","severity":"medium","exploited":false,"published_at":"2026-10-23T20:17:28.04+00:00","url":"https://junglewise.ai/threats/cve-2026-79981-the-dns-stub-resolver-in-subsys-net-lib-dns-resolve-c-binds-one"},{"cve":"CVE-2026-19737","cvss":5.5,"epss":0.001,"slug":"cve-2026-19737-i2s-esp32-trigger-check-in-drivers-i2s-i2s-esp32-c-validates-the","title":"Zephyr i2s_esp32 null pointer dereference in trigger validation","severity":"medium","exploited":false,"published_at":"2026-10-11T18:16:58.93+00:00","url":"https://junglewise.ai/threats/cve-2026-19737-i2s-esp32-trigger-check-in-drivers-i2s-i2s-esp32-c-validates-the"},{"cve":"CVE-2026-17053","cvss":4.4,"epss":0.0009,"slug":"cve-2026-17053-the-smbus-driver-api-exposed-smbus-smbalert-remove-cb-and-smbus","title":"Zephyr SMBus syscall privilege escalation in callback removal","severity":"medium","exploited":false,"published_at":"2026-10-01T16:17:41.51+00:00","url":"https://junglewise.ai/threats/cve-2026-17053-the-smbus-driver-api-exposed-smbus-smbalert-remove-cb-and-smbus"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":3}],"related":[{"name":"Zephyr RTOS","slug":"rtos","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/rtos"}],"technology":{"hub":true,"name":"Zephyr OS","slug":"zephyr-zephyr-os","vendor":{"hub":true,"name":"Zephyr","slug":"zephyr","url":"https://junglewise.ai/threats/vendors/zephyr"},"aliases":["zephyr-os-1"],"category":"os","description":"Real-time operating system for embedded and IoT devices.","url":"https://junglewise.ai/threats/technologies/zephyr-zephyr-os"},"most_severe":[{"cve":"CVE-2026-91007","cvss":7.8,"slug":"cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in","title":"Zephyr charger driver kernel privilege escalation via user-mode syscall verification","severity":"high","exploited":false,"published_at":"2026-11-12T16:19:21.25+00:00","url":"https://junglewise.ai/threats/cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in"},{"cve":"CVE-2026-87039","cvss":7.8,"slug":"cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers","title":"Zephyr I2S user-mode syscall verifier unvalidated pointer dereference","severity":"high","exploited":false,"published_at":"2026-11-04T06:17:06.623+00:00","url":"https://junglewise.ai/threats/cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers"},{"cve":"CVE-2026-81038","cvss":7.1,"slug":"cve-2026-81038-the-object-transfer-service-server-builds-its-object-action","title":"Zephyr Object Transfer Service OACP checksum uninitialized memory disclosure","severity":"high","exploited":false,"published_at":"2026-10-26T17:17:30.35+00:00","url":"https://junglewise.ai/threats/cve-2026-81038-the-object-transfer-service-server-builds-its-object-action"},{"cve":"CVE-2026-87044","cvss":6.5,"slug":"cve-2026-87044-the-mbed-tls-crypto-shim-driver-in-drivers-crypto-crypto-mbedtls","title":"Mbed TLS crypto shim driver heap exhaustion via unaborted PSA operations","severity":"medium","exploited":false,"published_at":"2026-11-04T06:17:07.313+00:00","url":"https://junglewise.ai/threats/cve-2026-87044-the-mbed-tls-crypto-shim-driver-in-drivers-crypto-crypto-mbedtls"},{"cve":"CVE-2026-82389","cvss":6.5,"slug":"cve-2026-82389-in-the-bluetooth-classic-hands-free-profile-audio-gateway-role","title":"Zephyr Bluetooth Classic HFP AG stack crash on RFCOMM connection failure","severity":"medium","exploited":false,"published_at":"2026-10-26T17:17:30.757+00:00","url":"https://junglewise.ai/threats/cve-2026-82389-in-the-bluetooth-classic-hands-free-profile-audio-gateway-role"},{"cve":"CVE-2026-79981","cvss":6.5,"slug":"cve-2026-79981-the-dns-stub-resolver-in-subsys-net-lib-dns-resolve-c-binds-one","title":"Zephyr DNS resolver predictable source port and transaction ID","severity":"medium","exploited":false,"published_at":"2026-10-23T20:17:28.04+00:00","url":"https://junglewise.ai/threats/cve-2026-79981-the-dns-stub-resolver-in-subsys-net-lib-dns-resolve-c-binds-one"},{"cve":"CVE-2026-90589","cvss":5.5,"epss":0.001,"slug":"cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack","title":"Zephyr kernel thread stack memory leak via k_thread_abort","severity":"medium","exploited":false,"published_at":"2026-11-09T22:18:57.27+00:00","url":"https://junglewise.ai/threats/cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack"},{"cve":"CVE-2026-19737","cvss":5.5,"epss":0.001,"slug":"cve-2026-19737-i2s-esp32-trigger-check-in-drivers-i2s-i2s-esp32-c-validates-the","title":"Zephyr i2s_esp32 null pointer dereference in trigger validation","severity":"medium","exploited":false,"published_at":"2026-10-11T18:16:58.93+00:00","url":"https://junglewise.ai/threats/cve-2026-19737-i2s-esp32-trigger-check-in-drivers-i2s-i2s-esp32-c-validates-the"},{"cve":"CVE-2026-82388","cvss":5.3,"slug":"cve-2026-82388-bt-hfp-hf-connect-in-subsys-bluetooth-host-classic-hfp-hf-c","title":"Zephyr HFP Hands-Free connection denial of service","severity":"medium","exploited":false,"published_at":"2026-10-26T17:17:30.62+00:00","url":"https://junglewise.ai/threats/cve-2026-82388-bt-hfp-hf-connect-in-subsys-bluetooth-host-classic-hfp-hf-c"},{"cve":"CVE-2026-90587","cvss":4.6,"epss":0.0018,"slug":"cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a","title":"Zephyr USB host stack null pointer dereference in device enumeration","severity":"medium","exploited":false,"published_at":"2026-11-09T22:18:56.97+00:00","url":"https://junglewise.ai/threats/cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}