Vendor
Zephyr Project vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 124 vulnerabilities in Zephyr Project: 6 in the last 7 days and 49 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126957, was published on 12 November 2026. 15 vulnerabilities in the last four weeks, level on the four before (15). 2 technologies have a page of their own.
- Last 7 days
- 6
- Last 90 days
- 49
- Critical, all time
- 3
- Exploited in the wild
- 0
About Zephyr Project
The Zephyr Project is a collaborative effort hosted by the Linux Foundation to develop a real-time operating system for resource-constrained devices.
Zephyr Project technologies
Latest Zephyr Project vulnerabilities
- CVE-2026-126957: Zephyr ICMP integer underflow in IPv4 option handlingmediumCVSS 5.3
- CVE-2026-90834: Zephyr UART wide-data syscall verifier NULL pointer dereferencemediumCVSS 5.5
- CVE-2026-90833: Zephyr RTOS simulated EEPROM driver integer overflow in range validationhighCVSS 7.8
- CVE-2026-87042: Zephyr PTP port unvalidated logMessageInterval denial of servicemediumCVSS 6.5
- CVE-2026-82391: Zephyr HTTP server HTTP/2 buffer overflow via static file servingcriticalCVSS 9.1
- CVE-2026-120514: Zephyr Project Manager stored cross-site scriptingmediumCVSS 5.4
- CVE-2026-87043: Zephyr entropy-device uninitialized read in random number generationmediumCVSS 4.8
- CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()highCVSS 8.8
- CVE-2026-85032: Zephyr MCTP over USB use-after-free in packet buffer handlingmediumCVSS 4.8
- CVE-2026-82961: Zephyr GPIO syscall pin validation bypasshighCVSS 7.8
- CVE-2026-79979: Zephyr arm64 MMU TLB invalidation memory isolation bypasshighCVSS 7.8
- CVE-2026-19741: Zephyr OpenThread hardcoded default joiner credentialhighCVSS 7.5
- CVE-2026-19947: Zephyr device multiplexer privilege escalation in devmuxmediumCVSS 5.3
- CVE-2026-19595: Zephyr RTIO syscall memory validation bypassmediumCVSS 6.1
- CVE-2026-76787: Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsingmediumCVSS 5.9
- CVE-2026-75084: CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsingmediumCVSS 6.8EPSS 0.3%
- CVE-2026-19673: Zephyr RTOS ethernet_recv buffer length validation bypasshighCVSS 7.1EPSS 0.3%
- CVE-2026-19940: Zephyr RTOS Bluetooth HFP AG work queue memory corruptionmediumCVSS 6.5EPSS 0.2%
- CVE-2026-19939: Zephyr AVDTP timeout corruption in A2DP session disconnectmediumCVSS 6.3EPSS 0.2%
- CVE-2026-19936: Zephyr Bluetooth Mesh delayable message queue race conditionmediumCVSS 4.8EPSS 0.1%
- CVE-2026-19935: Zephyr Bluetooth LE L2CAP use-after-free on dynamic channel teardownhighCVSS 7.5EPSS 0.2%
- CVE-2026-19739: Zephyr Bluetooth Link Layer memory leak in connection updatemediumCVSS 6.5EPSS 0.1%
- CVE-2026-19738: Zephyr Project Bluetooth Link Layer Control Procedure memory leak in CIS creationmediumCVSS 6.5EPSS 0.1%
- CVE-2026-19577: Zephyr RTOS IPv6 routing out-of-bounds read in neighbor resolutionhighCVSS 7.1EPSS 0.2%
- CVE-2026-19574: Zephyr ARM64 MMU ASID allocation collision in memory domain isolationhighCVSS 7EPSS 0.1%
Most severe Zephyr Project vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-13214: Zephyr OCPP client stack buffer overflow in GetConfiguration handlercriticalCVSS 9.8EPSS 0.5%
- CVE-2026-5067: Zephyr RTOS stack overflow in HTTP server WebSocket upgradecriticalCVSS 9.8
- CVE-2026-82391: Zephyr HTTP server HTTP/2 buffer overflow via static file servingcriticalCVSS 9.1
- CVE-2026-12366: Zephyr use-after-free in dynamic k_timer cleanuphighCVSS 8.8EPSS 0.2%
- CVE-2026-9771: Zephyr RTOS flash_copy() privilege escalation via unvalidated device pointershighCVSS 8.8EPSS 0.1%
- CVE-2026-19569: Zephyr kernel integer overflow in dynamic object allocationhighCVSS 8.8EPSS 0.1%
- CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()highCVSS 8.8
- CVE-2026-15894: Zephyr Bluetooth Mesh stack buffer overflow in solicitation handlerhighCVSS 8.8
- CVE-2026-10643: Zephyr RTOS heap overflow in IP socket recvmsg implementationhighCVSS 8.7
- CVE-2026-12364: Zephyr OS logging system-call validation bypasshighCVSS 8.4EPSS 0.2%
Vulnerabilities per week
15 vulnerabilities in the last four weeks, level on the four before (15). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 9 | 1 | |
| 31 Aug 2026 | 2 | 0 | |
| 7 Sep 2026 | 2 | 0 | |
| 14 Sep 2026 | 3 | 0 | |
| 21 Sep 2026 | 2 | 0 | |
| 28 Sep 2026 | 3 | 0 | |
| 5 Oct 2026 | 7 | 0 | |
| 12 Oct 2026 | 5 | 0 | |
| 19 Oct 2026 | 5 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 4 | 0 | |
| 9 Nov 2026 | 5 | 1 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Zephyr Project vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/zephyr-project)<a href="https://junglewise.ai/threats/vendors/zephyr-project"><img src="https://junglewise.ai/threats/vendors/zephyr-project/badge.svg" alt="Zephyr Project vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/zephyr-project.json, and this page as text at https://junglewise.ai/threats/vendors/zephyr-project.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Zephyr Project vulnerabilities", https://junglewise.ai/threats/vendors/zephyr-project, 13 November 2026.