# Zephyr Project Zephyr vulnerabilities

Source: https://junglewise.ai/threats/technologies/zephyr  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/zephyr.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 95 vulnerabilities in Zephyr Project Zephyr: 5 in the last 7 days and 40 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126957, was published on 12 November 2026. 10 vulnerabilities in the last four weeks, down 23% on the four before (13).

## Counts

- Last 7 days: 5
- Last 30 days: 12
- Last 90 days: 40
- All time: 95 (3 critical, 0 exploited in the wild)

## About Zephyr Project Zephyr

Zephyr is a real-time operating system for resource-constrained embedded systems.

## Latest Zephyr Project Zephyr vulnerabilities

- [CVE-2026-126957: Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a) (medium, CVSS 5.3, published 12 Nov 2026)
- [CVE-2026-90834: Zephyr UART wide-data syscall verifier NULL pointer dereference](https://junglewise.ai/threats/cve-2026-90834-the-user-mode-syscall-verifiers-for-the-16-bit-wide-data-uart-api) (medium, CVSS 5.5, published 10 Nov 2026)
- [CVE-2026-90833: Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom) (high, CVSS 7.8, published 10 Nov 2026)
- [CVE-2026-87042: Zephyr PTP port unvalidated logMessageInterval denial of service](https://junglewise.ai/threats/cve-2026-87042-the-ieee-1588-ptp-port-implementation-in-subsys-net-lib-ptp-port) (medium, CVSS 6.5, published 10 Nov 2026)
- [CVE-2026-82391: Zephyr HTTP server HTTP/2 buffer overflow via static file serving](https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection) (critical, CVSS 9.1, published 10 Nov 2026)
- [CVE-2026-87043: Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random) (medium, CVSS 4.8, published 4 Nov 2026)
- [CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter) (high, CVSS 8.8, published 3 Nov 2026)
- [CVE-2026-82961: Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not) (high, CVSS 7.8, published 28 Oct 2026)
- [CVE-2026-19741: Zephyr OpenThread hardcoded default joiner credential](https://junglewise.ai/threats/cve-2026-19741-zephyr-s-openthread-integration-defined-config-openthread-joiner) (high, CVSS 7.5, published 23 Oct 2026)
- [CVE-2026-19947: Zephyr device multiplexer privilege escalation in devmux](https://junglewise.ai/threats/cve-2026-19947-the-device-multiplexer-pseudo-driver-in-drivers-misc-devmux) (medium, CVSS 5.3, published 21 Oct 2026)
- [CVE-2026-19595: Zephyr RTIO syscall memory validation bypass](https://junglewise.ai/threats/cve-2026-19595-the-user-mode-syscall-verifier-z-vrfy-rtio-cqe-get-mempool-buffer) (medium, CVSS 6.1, published 19 Oct 2026)
- [CVE-2026-19673: Zephyr RTOS ethernet_recv buffer length validation bypass](https://junglewise.ai/threats/cve-2026-19673-ethernet-recv-in-subsys-net-l2-ethernet-ethernet-c-validates-only) (high, CVSS 7.1, published 14 Oct 2026)
- [CVE-2026-19940: Zephyr RTOS Bluetooth HFP AG work queue memory corruption](https://junglewise.ai/threats/cve-2026-19940-the-bluetooth-classic-hands-free-profile-audio-gateway) (medium, CVSS 6.5, published 13 Oct 2026)
- [CVE-2026-19939: Zephyr AVDTP timeout corruption in A2DP session disconnect](https://junglewise.ai/threats/cve-2026-19939-the-avdtp-signalling-layer-arms-a-6-second-command-timeout-avdtp) (medium, CVSS 6.3, published 13 Oct 2026)
- [CVE-2026-19936: Zephyr Bluetooth Mesh delayable message queue race condition](https://junglewise.ai/threats/cve-2026-19936-the-bluetooth-mesh-access-layer-delayable-message-queue-in-subsys) (medium, CVSS 4.8, published 13 Oct 2026)
- [CVE-2026-19935: Zephyr Bluetooth LE L2CAP use-after-free on dynamic channel teardown](https://junglewise.ai/threats/cve-2026-19935-the-bluetooth-le-host-queues-received-l2cap-connection-oriented) (high, CVSS 7.5, published 11 Oct 2026)
- [CVE-2026-19577: Zephyr RTOS IPv6 routing out-of-bounds read in neighbor resolution](https://junglewise.ai/threats/cve-2026-19577-net-route-ipv6-packet-in-subsys-net-ip-route-ipv6-c-resolved-the) (high, CVSS 7.1, published 11 Oct 2026)
- [CVE-2026-19574: Zephyr ARM64 MMU ASID allocation collision in memory domain isolation](https://junglewise.ai/threats/cve-2026-19574-the-arm64-mmu-back-end-allocated-address-space-identifiers-asids) (high, CVSS 7, published 9 Oct 2026)
- [CVE-2026-19569: Zephyr kernel integer overflow in dynamic object allocation](https://junglewise.ai/threats/cve-2026-19569-dynamic-object-create-in-kernel-userspace-userspace-c-computed) (high, CVSS 8.8, published 9 Oct 2026)
- [CVE-2026-15894: Zephyr Bluetooth Mesh stack buffer overflow in solicitation handler](https://junglewise.ai/threats/cve-2026-15894-the-bluetooth-mesh-on-demand-private-proxy-solicitation-handler) (high, CVSS 8.8, published 7 Oct 2026)
- [CVE-2026-18746: Zephyr LwM2M parse_write_op null pointer dereference in block handling](https://junglewise.ai/threats/cve-2026-18746-parse-write-op-in-subsys-net-lib-lwm2m-lwm2m-message-handling-c) (medium, CVSS 5.9, published 29 Sep 2026)
- [CVE-2026-18413: NXP MCUX LPADC driver buffer overflow in ADC sampling](https://junglewise.ai/threats/cve-2026-18413-the-adc-api-requires-each-driver-to-reject-a-sampling-sequence) (high, CVSS 7.8, published 28 Sep 2026)
- [CVE-2026-16513: Zephyr RTIO userspace verifier write-what-where in rtio_sqe_copy_in_get_handles()](https://junglewise.ai/threats/cve-2026-16513-the-userspace-verifier-z-vrfy-rtio-sqe-copy-in-get-handles-in) (high, CVSS 7.8, published 28 Sep 2026)
- [CVE-2026-15890: Zephyr PSA Trusted Storage AEAD nonce reuse in concurrent writes](https://junglewise.ai/threats/cve-2026-15890-the-default-aead-nonce-provider-for-the-psa-internal-trusted) (medium, CVSS 5.3, published 21 Sep 2026)
- [CVE-2026-17050: Zephyr RTOS USB host stack double-free in configuration descriptor](https://junglewise.ai/threats/cve-2026-17050-the-experimental-usb-host-stack-allocates-a-per-device) (medium, CVSS 5.7, published 21 Sep 2026)

## Most severe Zephyr Project Zephyr vulnerabilities

- [CVE-2026-13214: Zephyr OCPP client stack buffer overflow in GetConfiguration handler](https://junglewise.ai/threats/cve-2026-13214-zephyr-ocpp-client-stack-buffer-overflow-in-getconfiguration) (critical, CVSS 9.8, published 25 Aug 2026)
- [CVE-2026-5067: Zephyr RTOS stack overflow in HTTP server WebSocket upgrade](https://junglewise.ai/threats/cve-2026-5067-zephyr-rtos-stack-overflow-in-http-server-websocket-upgrade) (critical, CVSS 9.8, published 9 Jun 2026)
- [CVE-2026-82391: Zephyr HTTP server HTTP/2 buffer overflow via static file serving](https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection) (critical, CVSS 9.1, published 10 Nov 2026)
- [CVE-2026-12366: Zephyr use-after-free in dynamic k_timer cleanup](https://junglewise.ai/threats/cve-2026-12366-zephyr-use-after-free-in-dynamic-k-timer-cleanup) (high, CVSS 8.8, published 14 Aug 2026)
- [CVE-2026-9771: Zephyr RTOS flash_copy() privilege escalation via unvalidated device pointers](https://junglewise.ai/threats/cve-2026-9771-zephyr-rtos-flash-copy-privilege-escalation-via-unvalidated-device) (high, CVSS 8.8, published 17 Aug 2026)
- [CVE-2026-19569: Zephyr kernel integer overflow in dynamic object allocation](https://junglewise.ai/threats/cve-2026-19569-dynamic-object-create-in-kernel-userspace-userspace-c-computed) (high, CVSS 8.8, published 9 Oct 2026)
- [CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter) (high, CVSS 8.8, published 3 Nov 2026)
- [CVE-2026-15894: Zephyr Bluetooth Mesh stack buffer overflow in solicitation handler](https://junglewise.ai/threats/cve-2026-15894-the-bluetooth-mesh-on-demand-private-proxy-solicitation-handler) (high, CVSS 8.8, published 7 Oct 2026)
- [CVE-2026-10643: Zephyr RTOS heap overflow in IP socket recvmsg implementation](https://junglewise.ai/threats/cve-2026-10643-zephyr-rtos-heap-overflow-in-ip-socket-recvmsg-implementation) (high, CVSS 8.7, published 28 Jun 2026)
- [CVE-2026-8718: Zephyr DTLS Connection ID buffer overflow in getsockopt](https://junglewise.ai/threats/cve-2026-8718-zephyr-dtls-connection-id-buffer-overflow-in-getsockopt) (high, CVSS 8.4, published 10 Aug 2026)

## Vulnerabilities per week

10 vulnerabilities in the last four weeks, down 23% on the four before (13).

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 1 | 0 | 0 |
| 24 Aug 2026 | 8 | 1 | 0 |
| 31 Aug 2026 | 2 | 0 | 0 |
| 7 Sep 2026 | 1 | 0 | 0 |
| 14 Sep 2026 | 3 | 0 | 0 |
| 21 Sep 2026 | 2 | 0 | 0 |
| 28 Sep 2026 | 3 | 0 | 0 |
| 5 Oct 2026 | 5 | 0 | 0 |
| 12 Oct 2026 | 4 | 0 | 0 |
| 19 Oct 2026 | 3 | 0 | 0 |
| 26 Oct 2026 | 1 | 0 | 0 |
| 2 Nov 2026 | 2 | 0 | 0 |
| 9 Nov 2026 | 5 | 1 | 0 |

## Other Zephyr Project technologies

- [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os): 31 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Zephyr Project Zephyr vulnerabilities", https://junglewise.ai/threats/technologies/zephyr, 13 November 2026.