# Zephyr Project vulnerabilities Source: https://junglewise.ai/threats/vendors/zephyr-project Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/zephyr-project.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 124 vulnerabilities in Zephyr Project: 6 in the last 7 days and 49 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126957, was published on 12 November 2026. 15 vulnerabilities in the last four weeks, level on the four before (15). 2 technologies have a page of their own. ## Counts - Last 7 days: 6 - Last 30 days: 17 - Last 90 days: 49 - All time: 124 (3 critical, 0 exploited in the wild) ## About Zephyr Project The Zephyr Project is a collaborative effort hosted by the Linux Foundation to develop a real-time operating system for resource-constrained devices. ## Latest Zephyr Project vulnerabilities - [CVE-2026-126957: Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a) (medium, CVSS 5.3, published 12 Nov 2026) - [CVE-2026-90834: Zephyr UART wide-data syscall verifier NULL pointer dereference](https://junglewise.ai/threats/cve-2026-90834-the-user-mode-syscall-verifiers-for-the-16-bit-wide-data-uart-api) (medium, CVSS 5.5, published 10 Nov 2026) - [CVE-2026-90833: Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom) (high, CVSS 7.8, published 10 Nov 2026) - [CVE-2026-87042: Zephyr PTP port unvalidated logMessageInterval denial of service](https://junglewise.ai/threats/cve-2026-87042-the-ieee-1588-ptp-port-implementation-in-subsys-net-lib-ptp-port) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-82391: Zephyr HTTP server HTTP/2 buffer overflow via static file serving](https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection) (critical, CVSS 9.1, published 10 Nov 2026) - [CVE-2026-120514: Zephyr Project Manager stored cross-site scripting](https://junglewise.ai/threats/cve-2026-120514-the-zephyr-project-manager-plugin-for-wordpress-is-vulnerable-to) (medium, CVSS 5.4, published 7 Nov 2026) - [CVE-2026-87043: Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random) (medium, CVSS 4.8, published 4 Nov 2026) - [CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter) (high, CVSS 8.8, published 3 Nov 2026) - [CVE-2026-85032: Zephyr MCTP over USB use-after-free in packet buffer handling](https://junglewise.ai/threats/cve-2026-85032-the-mctp-over-usb-device-class-in-subsys-pmci-mctp-mctp-usb-c) (medium, CVSS 4.8, published 3 Nov 2026) - [CVE-2026-82961: Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not) (high, CVSS 7.8, published 28 Oct 2026) - [CVE-2026-79979: Zephyr arm64 MMU TLB invalidation memory isolation bypass](https://junglewise.ai/threats/cve-2026-79979-the-arm64-mmu-backend-invalidates-a-single-virtual-address-from) (high, CVSS 7.8, published 23 Oct 2026) - [CVE-2026-19741: Zephyr OpenThread hardcoded default joiner credential](https://junglewise.ai/threats/cve-2026-19741-zephyr-s-openthread-integration-defined-config-openthread-joiner) (high, CVSS 7.5, published 23 Oct 2026) - [CVE-2026-19947: Zephyr device multiplexer privilege escalation in devmux](https://junglewise.ai/threats/cve-2026-19947-the-device-multiplexer-pseudo-driver-in-drivers-misc-devmux) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-19595: Zephyr RTIO syscall memory validation bypass](https://junglewise.ai/threats/cve-2026-19595-the-user-mode-syscall-verifier-z-vrfy-rtio-cqe-get-mempool-buffer) (medium, CVSS 6.1, published 19 Oct 2026) - [CVE-2026-76787: Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsing](https://junglewise.ai/threats/cve-2026-76787-the-updatehub-firmware-over-the-air-client-parses-the-coap-probe) (medium, CVSS 5.9, published 19 Oct 2026) - [CVE-2026-75084: CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsing](https://junglewise.ai/threats/cve-2026-75084-the-cc1200-sub-ghz-ieee-802-15-4-driver-takes-the-phy-packet) (medium, CVSS 6.8, published 14 Oct 2026) - [CVE-2026-19673: Zephyr RTOS ethernet_recv buffer length validation bypass](https://junglewise.ai/threats/cve-2026-19673-ethernet-recv-in-subsys-net-l2-ethernet-ethernet-c-validates-only) (high, CVSS 7.1, published 14 Oct 2026) - [CVE-2026-19940: Zephyr RTOS Bluetooth HFP AG work queue memory corruption](https://junglewise.ai/threats/cve-2026-19940-the-bluetooth-classic-hands-free-profile-audio-gateway) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-19939: Zephyr AVDTP timeout corruption in A2DP session disconnect](https://junglewise.ai/threats/cve-2026-19939-the-avdtp-signalling-layer-arms-a-6-second-command-timeout-avdtp) (medium, CVSS 6.3, published 13 Oct 2026) - [CVE-2026-19936: Zephyr Bluetooth Mesh delayable message queue race condition](https://junglewise.ai/threats/cve-2026-19936-the-bluetooth-mesh-access-layer-delayable-message-queue-in-subsys) (medium, CVSS 4.8, published 13 Oct 2026) - [CVE-2026-19935: Zephyr Bluetooth LE L2CAP use-after-free on dynamic channel teardown](https://junglewise.ai/threats/cve-2026-19935-the-bluetooth-le-host-queues-received-l2cap-connection-oriented) (high, CVSS 7.5, published 11 Oct 2026) - [CVE-2026-19739: Zephyr Bluetooth Link Layer memory leak in connection update](https://junglewise.ai/threats/cve-2026-19739-the-bluetooth-link-layer-control-procedure-code-in-subsys) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-19738: Zephyr Project Bluetooth Link Layer Control Procedure memory leak in CIS creation](https://junglewise.ai/threats/cve-2026-19738-the-bluetooth-link-layer-control-procedure-llcp-implementation) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-19577: Zephyr RTOS IPv6 routing out-of-bounds read in neighbor resolution](https://junglewise.ai/threats/cve-2026-19577-net-route-ipv6-packet-in-subsys-net-ip-route-ipv6-c-resolved-the) (high, CVSS 7.1, published 11 Oct 2026) - [CVE-2026-19574: Zephyr ARM64 MMU ASID allocation collision in memory domain isolation](https://junglewise.ai/threats/cve-2026-19574-the-arm64-mmu-back-end-allocated-address-space-identifiers-asids) (high, CVSS 7, published 9 Oct 2026) ## Most severe Zephyr Project vulnerabilities - [CVE-2026-13214: Zephyr OCPP client stack buffer overflow in GetConfiguration handler](https://junglewise.ai/threats/cve-2026-13214-zephyr-ocpp-client-stack-buffer-overflow-in-getconfiguration) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-5067: Zephyr RTOS stack overflow in HTTP server WebSocket upgrade](https://junglewise.ai/threats/cve-2026-5067-zephyr-rtos-stack-overflow-in-http-server-websocket-upgrade) (critical, CVSS 9.8, published 9 Jun 2026) - [CVE-2026-82391: Zephyr HTTP server HTTP/2 buffer overflow via static file serving](https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection) (critical, CVSS 9.1, published 10 Nov 2026) - [CVE-2026-12366: Zephyr use-after-free in dynamic k_timer cleanup](https://junglewise.ai/threats/cve-2026-12366-zephyr-use-after-free-in-dynamic-k-timer-cleanup) (high, CVSS 8.8, published 14 Aug 2026) - [CVE-2026-9771: Zephyr RTOS flash_copy() privilege escalation via unvalidated device pointers](https://junglewise.ai/threats/cve-2026-9771-zephyr-rtos-flash-copy-privilege-escalation-via-unvalidated-device) (high, CVSS 8.8, published 17 Aug 2026) - [CVE-2026-19569: Zephyr kernel integer overflow in dynamic object allocation](https://junglewise.ai/threats/cve-2026-19569-dynamic-object-create-in-kernel-userspace-userspace-c-computed) (high, CVSS 8.8, published 9 Oct 2026) - [CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter) (high, CVSS 8.8, published 3 Nov 2026) - [CVE-2026-15894: Zephyr Bluetooth Mesh stack buffer overflow in solicitation handler](https://junglewise.ai/threats/cve-2026-15894-the-bluetooth-mesh-on-demand-private-proxy-solicitation-handler) (high, CVSS 8.8, published 7 Oct 2026) - [CVE-2026-10643: Zephyr RTOS heap overflow in IP socket recvmsg implementation](https://junglewise.ai/threats/cve-2026-10643-zephyr-rtos-heap-overflow-in-ip-socket-recvmsg-implementation) (high, CVSS 8.7, published 28 Jun 2026) - [CVE-2026-12364: Zephyr OS logging system-call validation bypass](https://junglewise.ai/threats/cve-2026-12364-zephyr-os-logging-system-call-validation-bypass) (high, CVSS 8.4, published 14 Aug 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, level on the four before (15). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 9 | 1 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 3 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 7 | 0 | 0 | | 12 Oct 2026 | 5 | 0 | 0 | | 19 Oct 2026 | 5 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 4 | 0 | 0 | | 9 Nov 2026 | 5 | 1 | 0 | ## Zephyr Project technologies - [Zephyr Project Zephyr](https://junglewise.ai/threats/technologies/zephyr): 95 vulnerabilities - [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os): 31 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Zephyr Project vulnerabilities", https://junglewise.ai/threats/vendors/zephyr-project, 13 November 2026.