# Zephyr vulnerabilities

Source: https://junglewise.ai/threats/vendors/zephyr  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/zephyr.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 45 vulnerabilities in Zephyr: 8 in the last 7 days and 43 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-16659, was published on 13 November 2026. 23 vulnerabilities in the last four weeks, up 77% on the four before (13). 2 technologies have a page of their own.

## Counts

- Last 7 days: 8
- Last 30 days: 28
- Last 90 days: 43
- All time: 45 (0 critical, 0 exploited in the wild)

## About Zephyr

Software or technology company.

## Latest Zephyr vulnerabilities

- [CVE-2026-16659: MCUboot serial-recovery NULL pointer dereference in encryption handler](https://junglewise.ai/threats/cve-2026-16659-mcuboot-s-serial-recovery-image-upload-handler-bs-upload-in-boot) (medium, CVSS 4, published 13 Nov 2026)
- [CVE-2026-91007: Zephyr charger driver kernel privilege escalation via user-mode syscall verification](https://junglewise.ai/threats/cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in) (high, CVSS 7.8, published 12 Nov 2026)
- [CVE-2026-90832: Zephyr Bluetooth HCI out-of-bounds read in periodic advertising](https://junglewise.ai/threats/cve-2026-90832-bt-hci-le-per-adv-report-common-in-subsys-bluetooth-host-scan-c) (medium, CVSS 4.3, published 10 Nov 2026)
- [CVE-2026-77685: Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys) (high, CVSS 8.3, published 10 Nov 2026)
- [CVE-2026-90589: Zephyr kernel thread stack memory leak via k_thread_abort](https://junglewise.ai/threats/cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack) (medium, CVSS 5.5, published 9 Nov 2026)
- [CVE-2026-90587: Zephyr USB host stack null pointer dereference in device enumeration](https://junglewise.ai/threats/cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a) (medium, CVSS 4.6, published 9 Nov 2026)
- [CVE-2026-90586: Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread) (high, CVSS 7.8, published 9 Nov 2026)
- [CVE-2026-87045: Zephyr HTTP/2 server NULL pointer dereference in stream binding](https://junglewise.ai/threats/cve-2026-87045-the-http-2-server-in-subsys-net-lib-http-http-server-http2-c) (high, CVSS 7.5, published 6 Nov 2026)
- [CVE-2026-87044: Mbed TLS crypto shim driver heap exhaustion via unaborted PSA operations](https://junglewise.ai/threats/cve-2026-87044-the-mbed-tls-crypto-shim-driver-in-drivers-crypto-crypto-mbedtls) (medium, CVSS 6.5, published 4 Nov 2026)
- [CVE-2026-87041: Zephyr RTIO submission-queue verifier memory access bypass](https://junglewise.ai/threats/cve-2026-87041-the-rtio-submission-queue-verifier-rtio-vrfy-sqe-in-subsys-rtio) (high, CVSS 7.8, published 4 Nov 2026)
- [CVE-2026-87039: Zephyr I2S user-mode syscall verifier unvalidated pointer dereference](https://junglewise.ai/threats/cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers) (high, CVSS 7.8, published 4 Nov 2026)
- [CVE-2026-87038: Zephyr i3c_transfer TOCTOU privilege escalation](https://junglewise.ai/threats/cve-2026-87038-the-user-mode-verification-handler-for-the-i3c-transfer-system) (high, CVSS 7, published 4 Nov 2026)
- [CVE-2026-85036: Zephyr Bluetooth Classic AVDTP memory corruption in work queue](https://junglewise.ai/threats/cve-2026-85036-the-bluetooth-classic-avdtp-layer-defers-releasing-a-session-s) (medium, CVSS 5.7, published 4 Nov 2026)
- [CVE-2026-16511: Zephyr RTIO syscall verifier privilege escalation](https://junglewise.ai/threats/cve-2026-16511-two-rtio-syscall-verifiers-in-subsys-rtio-rtio-syscalls-c-subsys) (high, CVSS 8.8, published 4 Nov 2026)
- [CVE-2026-85034: Zephyr Bluetooth GATT client buffer overflow on oversized notifications](https://junglewise.ai/threats/cve-2026-85034-the-bluetooth-host-s-gatt-client-passed-the-value-of-a-received) (medium, CVSS 6.7, published 3 Nov 2026)
- [CVE-2026-85033: Zephyr AVRCP Target vendor response buffer leak on disconnection](https://junglewise.ai/threats/cve-2026-85033-the-avrcp-target-role-in-subsys-bluetooth-host-classic-avrcp-c) (medium, CVSS 4.6, published 3 Nov 2026)
- [CVE-2026-82962: Zephyr ethernet_fill_header() out-of-bounds write via routing](https://junglewise.ai/threats/cve-2026-82962-ethernet-fill-header-in-subsys-net-l2-ethernet-ethernet-c-can) (medium, CVSS 6.5, published 28 Oct 2026)
- [CVE-2026-82389: Zephyr Bluetooth Classic HFP AG stack crash on RFCOMM connection failure](https://junglewise.ai/threats/cve-2026-82389-in-the-bluetooth-classic-hands-free-profile-audio-gateway-role) (medium, CVSS 6.5, published 26 Oct 2026)
- [CVE-2026-82388: Zephyr HFP Hands-Free connection denial of service](https://junglewise.ai/threats/cve-2026-82388-bt-hfp-hf-connect-in-subsys-bluetooth-host-classic-hfp-hf-c) (medium, CVSS 5.3, published 26 Oct 2026)
- [CVE-2026-81039: Zephyr Bluetooth host connection reservation exhaustion](https://junglewise.ai/threats/cve-2026-81039-the-bluetooth-host-pre-allocates-a-bt-conn-object-a-reservation) (medium, CVSS 4.3, published 26 Oct 2026)
- [CVE-2026-81038: Zephyr Object Transfer Service OACP checksum uninitialized memory disclosure](https://junglewise.ai/threats/cve-2026-81038-the-object-transfer-service-server-builds-its-object-action) (high, CVSS 7.1, published 26 Oct 2026)
- [CVE-2026-79982: Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack) (high, CVSS 8.8, published 23 Oct 2026)
- [CVE-2026-79981: Zephyr DNS resolver predictable source port and transaction ID](https://junglewise.ai/threats/cve-2026-79981-the-dns-stub-resolver-in-subsys-net-lib-dns-resolve-c-binds-one) (medium, CVSS 6.5, published 23 Oct 2026)
- [CVE-2026-79980: Zephyr DHCPv4 client predictable transaction ID allows gateway hijacking](https://junglewise.ai/threats/cve-2026-79980-the-dhcpv4-client-in-subsys-net-lib-dhcpv4-dhcpv4-c-maintained) (medium, CVSS 5.6, published 23 Oct 2026)
- [CVE-2026-78118: Zephyr kernel race condition in timer expiration handler](https://junglewise.ai/threats/cve-2026-78118-the-kernel-helper-z-waitq-head-kernel-include-wait-q-h-reads-the) (high, CVSS 7, published 21 Oct 2026)

## Most severe Zephyr vulnerabilities

- [CVE-2026-19570: Zephyr LE Audio Broadcast Sink buffer overflow in BAP metadata](https://junglewise.ai/threats/cve-2026-19570-the-le-audio-broadcast-sink-in-subsys-bluetooth-audio-bap) (high, CVSS 8.8, published 9 Oct 2026)
- [CVE-2026-16511: Zephyr RTIO syscall verifier privilege escalation](https://junglewise.ai/threats/cve-2026-16511-two-rtio-syscall-verifiers-in-subsys-rtio-rtio-syscalls-c-subsys) (high, CVSS 8.8, published 4 Nov 2026)
- [CVE-2026-79982: Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack) (high, CVSS 8.8, published 23 Oct 2026)
- [CVE-2026-76788: Zephyr OSDP Control Panel stack buffer overflow in reply parser](https://junglewise.ai/threats/cve-2026-76788-the-osdp-control-panel-reply-parser-cp-decode-response-in-subsys) (high, CVSS 8.8, published 19 Oct 2026)
- [CVE-2026-19184: NXP GAU ADC driver buffer overflow in adc_mcux_gau_adc](https://junglewise.ai/threats/cve-2026-19184-the-nxp-gau-adc-driver-drivers-adc-adc-mcux-gau-adc-c-validated) (high, CVSS 8.4, published 5 Oct 2026)
- [CVE-2026-77685: Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys) (high, CVSS 8.3, published 10 Nov 2026)
- [CVE-2026-19186: Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption](https://junglewise.ai/threats/cve-2026-19186-ieee802154-decipher-data-frame-in-subsys-net-l2-ieee802154) (high, CVSS 8.1, published 7 Oct 2026)
- [CVE-2026-19669: Zephyr fuel gauge syscall stack buffer overflow](https://junglewise.ai/threats/cve-2026-19669-the-user-mode-syscall-verifiers-z-vrfy-fuel-gauge-get-props-and-z) (high, CVSS 7.8, published 11 Oct 2026)
- [CVE-2026-17052: Zephyr RTOS Time-aware GPIO syscall memory write check bypass](https://junglewise.ai/threats/cve-2026-17052-the-time-aware-gpio-syscall-verification-handler-z-vrfy-tgpio-pin) (high, CVSS 7.8, published 21 Sep 2026)
- [CVE-2026-90586: Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread) (high, CVSS 7.8, published 9 Nov 2026)

## Vulnerabilities per week

23 vulnerabilities in the last four weeks, up 77% on the four before (13).

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 1 | 0 | 0 |
| 21 Sep 2026 | 1 | 0 | 0 |
| 28 Sep 2026 | 3 | 0 | 0 |
| 5 Oct 2026 | 8 | 0 | 0 |
| 12 Oct 2026 | 2 | 0 | 0 |
| 19 Oct 2026 | 7 | 0 | 0 |
| 26 Oct 2026 | 5 | 0 | 0 |
| 2 Nov 2026 | 9 | 0 | 0 |
| 9 Nov 2026 | 7 | 0 | 0 |

## Zephyr technologies

- [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos): 25 vulnerabilities
- [Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-zephyr-os): 12 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Zephyr vulnerabilities", https://junglewise.ai/threats/vendors/zephyr, 13 November 2026.