Vendor
Zephyr vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 45 vulnerabilities in Zephyr: 8 in the last 7 days and 43 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-16659, was published on 13 November 2026. 23 vulnerabilities in the last four weeks, up 77% on the four before (13). 2 technologies have a page of their own.
- Last 7 days
- 8
- Last 90 days
- 43
- Critical, all time
- 0
- Exploited in the wild
- 0
About Zephyr
Software or technology company.
Zephyr technologies
Latest Zephyr vulnerabilities
- CVE-2026-16659: MCUboot serial-recovery NULL pointer dereference in encryption handlermediumCVSS 4
- CVE-2026-91007: Zephyr charger driver kernel privilege escalation via user-mode syscall verificationhighCVSS 7.8
- CVE-2026-90832: Zephyr Bluetooth HCI out-of-bounds read in periodic advertisingmediumCVSS 4.3
- CVE-2026-77685: Zephyr RFCOMM multiplexer buffer overflow and information disclosurehighCVSS 8.3
- CVE-2026-90589: Zephyr kernel thread stack memory leak via k_thread_abortmediumCVSS 5.5EPSS 0.1%
- CVE-2026-90587: Zephyr USB host stack null pointer dereference in device enumerationmediumCVSS 4.6EPSS 0.2%
- CVE-2026-90586: Xtensa MMU uninitialized page-table pointer in userspace thread setuphighCVSS 7.8EPSS 0.1%
- CVE-2026-87045: Zephyr HTTP/2 server NULL pointer dereference in stream bindinghighCVSS 7.5
- CVE-2026-87044: Mbed TLS crypto shim driver heap exhaustion via unaborted PSA operationsmediumCVSS 6.5
- CVE-2026-87041: Zephyr RTIO submission-queue verifier memory access bypasshighCVSS 7.8
- CVE-2026-87039: Zephyr I2S user-mode syscall verifier unvalidated pointer dereferencehighCVSS 7.8
- CVE-2026-87038: Zephyr i3c_transfer TOCTOU privilege escalationhighCVSS 7
- CVE-2026-85036: Zephyr Bluetooth Classic AVDTP memory corruption in work queuemediumCVSS 5.7
- CVE-2026-16511: Zephyr RTIO syscall verifier privilege escalationhighCVSS 8.8
- CVE-2026-85034: Zephyr Bluetooth GATT client buffer overflow on oversized notificationsmediumCVSS 6.7
- CVE-2026-85033: Zephyr AVRCP Target vendor response buffer leak on disconnectionmediumCVSS 4.6
- CVE-2026-82962: Zephyr ethernet_fill_header() out-of-bounds write via routingmediumCVSS 6.5
- CVE-2026-82389: Zephyr Bluetooth Classic HFP AG stack crash on RFCOMM connection failuremediumCVSS 6.5
- CVE-2026-82388: Zephyr HFP Hands-Free connection denial of servicemediumCVSS 5.3
- CVE-2026-81039: Zephyr Bluetooth host connection reservation exhaustionmediumCVSS 4.3
- CVE-2026-81038: Zephyr Object Transfer Service OACP checksum uninitialized memory disclosurehighCVSS 7.1
- CVE-2026-79982: Zephyr Bluetooth HCI USB buffer overflow in controller-to-host pathhighCVSS 8.8
- CVE-2026-79981: Zephyr DNS resolver predictable source port and transaction IDmediumCVSS 6.5
- CVE-2026-79980: Zephyr DHCPv4 client predictable transaction ID allows gateway hijackingmediumCVSS 5.6
- CVE-2026-78118: Zephyr kernel race condition in timer expiration handlerhighCVSS 7
Most severe Zephyr vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-19570: Zephyr LE Audio Broadcast Sink buffer overflow in BAP metadatahighCVSS 8.8EPSS 0.3%
- CVE-2026-16511: Zephyr RTIO syscall verifier privilege escalationhighCVSS 8.8
- CVE-2026-79982: Zephyr Bluetooth HCI USB buffer overflow in controller-to-host pathhighCVSS 8.8
- CVE-2026-76788: Zephyr OSDP Control Panel stack buffer overflow in reply parserhighCVSS 8.8
- CVE-2026-19184: NXP GAU ADC driver buffer overflow in adc_mcux_gau_adchighCVSS 8.4EPSS 0.1%
- CVE-2026-77685: Zephyr RFCOMM multiplexer buffer overflow and information disclosurehighCVSS 8.3
- CVE-2026-19186: Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryptionhighCVSS 8.1
- CVE-2026-19669: Zephyr fuel gauge syscall stack buffer overflowhighCVSS 7.8EPSS 0.1%
- CVE-2026-17052: Zephyr RTOS Time-aware GPIO syscall memory write check bypasshighCVSS 7.8EPSS 0.1%
- CVE-2026-90586: Xtensa MMU uninitialized page-table pointer in userspace thread setuphighCVSS 7.8EPSS 0.1%
Vulnerabilities per week
23 vulnerabilities in the last four weeks, up 77% on the four before (13). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 3 | 0 | |
| 5 Oct 2026 | 8 | 0 | |
| 12 Oct 2026 | 2 | 0 | |
| 19 Oct 2026 | 7 | 0 | |
| 26 Oct 2026 | 5 | 0 | |
| 2 Nov 2026 | 9 | 0 | |
| 9 Nov 2026 | 7 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Zephyr vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/zephyr)<a href="https://junglewise.ai/threats/vendors/zephyr"><img src="https://junglewise.ai/threats/vendors/zephyr/badge.svg" alt="Zephyr vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/zephyr.json, and this page as text at https://junglewise.ai/threats/vendors/zephyr.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Zephyr vulnerabilities", https://junglewise.ai/threats/vendors/zephyr, 13 November 2026.