CVE-2026-18748 is a low-severity vulnerability in the Zephyr Bluetooth Classic A2DP host stack where an attacker can cause the system to disclose adjacent memory contents. This occurs because the code copies only the first 8 bytes of a codec Information Element (IE) but retains an attacker-controlled length field, leading to out-of-bounds reads when responding to configuration requests. The flaw requires a paired AVDTP peer using a non-SBC codec and specific configuration options enabled. The issue does not allow writes or code execution, only bounded memory disclosure. A fix is available that rejects oversized codec IEs instead of truncating them.
CVE-2026-78116 is a use-after-free vulnerability in the Broadcom AFBR-S50 time-of-flight sensor driver within Zephyr OS versions 4.3.0 up to but not including 4.5.0. The flaw occurs when sensor data evaluation fails, causing the same RTIO submission to be completed twice, leading to memory corruption and potential loss of availability. The issue can be triggered by environmental sensor conditions without requiring software or physical access. A fix is available in Zephyr version 4.5.0.
CVE-2026-19676 is a memory safety vulnerability in the Zephyr project's PECI driver subsystem. The user-mode verifier for the peci_transfer() system call fails to properly validate embedded buffer pointers within the peci_msg structure, allowing a user-mode thread with PECI device access to perform arbitrary kernel memory reads and writes. This flaw enables a full user-to-kernel privilege escalation, potentially leading to kernel code execution. Exploitation requires user-mode code with PECI device permissions and specific PECI drivers enabled. The vulnerability is addressed by adding explicit memory read/write checks on the embedded buffers.
CVE-2026-77684 is a denial-of-service vulnerability in the Bluetooth Classic Hands-Free Profile (HFP) HF role implementation in Zephyr OS versions 4.2.0 through 4.4.2. The flaw occurs because AT command buffers queued for transmission are not released when the RFCOMM data link connection goes down, leading to exhaustion of a fixed buffer pool. This causes permanent failure in sending HFP commands and can halt the Bluetooth RX thread, requiring a device reboot. The issue requires an established HFP session and a build with CONFIG_BT_HFP_HF enabled.
CVE-2026-19595 is a memory-safety vulnerability in the Zephyr RTOS subsystem RTIO. The syscall verifier incorrectly validates output parameters for write access, allowing an unprivileged user-mode thread with RTIO context access to cause kernel-mode writes to memory regions that should be read-only. This can lead to either bypassing memory domain write protections or triggering a kernel fault causing device halt or reboot (denial of service). The flaw is fixed by correcting the validation to require write permissions before the syscall implementation runs.
CVE-2026-76788 is a high-severity vulnerability in the Zephyr project's OSDP Control Panel reply parser. It arises from insufficient bounds checking on payload lengths in certain reply types, allowing an attacker with access to the RS-485 bus to cause a stack-based buffer overflow. This can lead to crashes or potential control-flow hijacking in the OSDP receive thread. The flaw affects Zephyr versions from 3.3.0 through 4.4.2.
CVE-2026-76787 is a memory-safety vulnerability in the Zephyr project's UpdateHub firmware-over-the-air client. It arises from improper handling of a missing "sha256sum" string in CoAP probe responses, leading to a null pointer dereference during string length calculation. This flaw allows a remote attacker to cause a denial of service by crashing or halting the system. The vulnerability is exploitable without authentication when DTLS is disabled, allowing on-path or off-path attackers to deliver malformed metadata. The issue is fixed in Zephyr version 4.5.0.
CVE-2026-75085 is a medium severity vulnerability in the STM32WBA IEEE 802.15.4 driver of the Zephyr project. The driver incorrectly computes the packet length of received frames without validating that the length can accommodate the Frame Check Sequence (FCS). This leads to an underflow in the length calculation, causing an out-of-bounds read of adjacent memory when processing malformed frames. The flaw allows an attacker within radio range to influence the length value and potentially cause disclosure of adjacent RAM contents. The issue affects Zephyr versions 4.3.0 through 4.4.2. A fix involves rejecting frames with lengths smaller than the FCS and adding runtime length checks to prevent oversized frames.
CVE-2026-75084 is a vulnerability in the Zephyr project's CC1200 sub-GHz IEEE 802.15.4 driver. The driver improperly validates the PHY packet length, allowing an attacker within radio range to send a frame with an invalid length byte exceeding the IEEE 802.15.4 maximum. This leads to a buffer overflow in the network buffer pool, causing corruption and potential crashes. The flaw requires no authentication or user interaction and affects builds with CONFIG_IEEE802154_CC1200 enabled and an attached CC1200 radio.
CVE-2026-19673 is a vulnerability in the Zephyr project affecting Ethernet frame processing when VLAN is enabled on the interface. The issue arises because the ethernet_recv() function improperly validates buffer lengths when handling VLAN-tagged frames, leading to out-of-bounds reads and buffer underflows. This can cause a remote denial of service and potential information disclosure or memory corruption. Only configurations with VLAN enabled and without hardware VLAN tag stripping are affected. The vulnerability has a CVSS score of 7.1 (high severity).
CVE-2026-75083 is an integer overflow vulnerability in the NXP KW41Z IEEE 802.15.4 driver within the Zephyr project. It occurs in the kw41z_rx() function where the payload size is computed incorrectly, leading to an underflow and subsequent buffer overflow in the network buffer pool. This can cause memory corruption and likely crashes due to overwriting adjacent memory. The vulnerability is triggered by unauthenticated frames with a crafted length field sent over the air. The issue affects Zephyr versions from 1.8.0 up to but not including 4.5.0.
CVE-2026-19940 is a use-after-free vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway implementation of Zephyr. It occurs due to improper handling of work items in a static pool during ACL connection teardown and re-creation. This leads to kernel timeout list corruption, causing system faults or hangs and resulting in denial of service. The vulnerability affects Zephyr versions 4.2.0 through 4.4.2 with CONFIG_BT_HFP_AG enabled and the asynchronous get_ongoing_call callback implemented. No code execution or data corruption is possible from this flaw.
CVE-2026-19939 is a medium severity memory-safety vulnerability in the Zephyr project affecting the Bluetooth AVDTP signalling layer. It arises from improper handling of a delayed work item during AVDTP signalling channel disconnect and reconnect events, leading to kernel data structure corruption and potential system-wide crash or hang. The issue requires an encrypted BR/EDR Bluetooth link and the experimental CONFIG_BT_A2DP option enabled. The vulnerability affects Zephyr versions from 3.7.0 through 4.4.2.
CVE-2026-19938 is a use-after-free vulnerability in the Zephyr Bluetooth host ATT transmit path. It occurs when the ATT Signed Write Command fails signing due to missing local CSRK keys, causing a buffer to be freed incorrectly and later reused. This leads to host-side memory corruption, including list corruption, double frees, and out-of-bounds writes, typically resulting in crashes or assertion failures. The vulnerability requires the deprecated CONFIG_BT_SIGNING to be enabled and an application issuing signed writes. It affects Zephyr versions from 2.3.0 up to but not including 4.5.0.
CVE-2026-19937 is a denial of service vulnerability in the Zephyr Bluetooth Mesh Access layer affecting versions 3.6.0 through 4.4.2. It involves a resource leak in the delayable-message context pool when handling segmented messages under certain conditions, causing the device to silently drop replies and become unresponsive until rebooted. There is no memory corruption or data integrity impact.
CVE-2026-19936 is a race condition vulnerability in the Zephyr Bluetooth Mesh Access-layer delayable message queue. It arises from unsynchronized access to shared lists and a delayable work item between two cooperative threads, leading to potential null pointer dereferences and duplicated message transmissions. The vulnerability can cause the system workqueue thread to abort or the node to reset, resulting in loss of availability. It does not allow memory corruption or code execution. A fix is available that serializes list mutations with a spinlock and removes unsafe list operations.
CVE-2026-19740 is a denial-of-service vulnerability in the Zephyr Bluetooth LE Controller's Link Layer Control Procedure (LLCP) implementation. A crafted sequence of Bluetooth LE control PDUs can cause the controller to leak receive nodes or trigger an assertion failure, exhausting the receive pool and rendering Bluetooth inoperable until reboot. The issue affects Zephyr versions from 3.4.0 up to but not including 4.5.0. The vulnerability does not lead to memory corruption or information disclosure, only availability impact.
CVE-2026-19739 is a denial of service vulnerability in the Zephyr Bluetooth Link Layer controller affecting versions from 3.4.0 up to but not including 4.5.0. The flaw involves improper handling of retained RX nodes during Connection Update or Connection Parameter procedures, which can lead to either a fatal controller error or exhaustion of the controller's RX buffer pool. This vulnerability can be triggered remotely by a peer device without requiring pairing, bonding, or encryption, causing persistent denial of service until the device is rebooted. There is no memory corruption or information disclosure associated with this issue.
CVE-2026-19738 is a denial-of-service vulnerability in the Zephyr project's Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation. The flaw causes memory nodes to be orphaned and not released when invalid PDUs are received, leading to resource exhaustion. An attacker within radio range can trigger this without authentication or encryption by sending crafted LL Control PDUs. The impact is limited to availability, causing system resets or stalled flow control requiring a reboot to recover.
CVE-2026-19935 is a use-after-free vulnerability in the Zephyr Bluetooth LE host's handling of L2CAP connection-oriented channel (CoC) data when using dynamic PSMs (0x0080-0x00FF). The issue arises because the channel teardown process does not cancel a queued work item (rx_work) that references the channel, allowing a remote unauthenticated peer to trigger use-after-free by sending a data K-frame followed immediately by an L2CAP Disconnect Request. This can lead to memory corruption or workqueue malfunction. The vulnerability affects Zephyr versions from 2.0.0 through 4.4.2 and has a CVSS 3.1 score of 7.5 (high severity).