CVE-2026-19575 is a memory safety vulnerability in the Zephyr RTOS affecting the device_deinit() system call handler in user mode. The flaw arises because the verification handler improperly validates the device argument, allowing a user-mode thread to pass arbitrary kernel objects it has permission on, leading to kernel memory corruption and an indirect call to an attacker-controlled address. This enables local unprivileged threads to achieve full kernel code execution, bypassing CONFIG_USERSPACE isolation. The vulnerability affects Zephyr versions 4.2.0 up to but not including 4.3.2, and 4.4.0 up to but not including 4.5.0, with fixes available in versions 4.3.2 and 4.5.0. Exploitation causes high impact including confidentiality, integrity, and availability compromise.
CVE-2026-19569 is an integer overflow vulnerability in the Zephyr kernel's dynamic object allocation code. It occurs when user-mode input leads to unsigned wrap-around in size calculations, causing undersized heap allocations that are overwritten by kernel object initialization. This allows an unprivileged user-mode thread to perform out-of-bounds writes in kernel memory, potentially corrupting kernel objects or enabling kernel code execution. The vulnerability requires specific kernel configurations (CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS) and a thread with an assigned resource pool. Fixed in Zephyr versions 4.3.2 and 4.5.0.
CVE-2026-19574 is a high-severity vulnerability in the Zephyr RTOS on ARM64 architectures affecting memory domain isolation. The ARM64 MMU backend uses a round-robin counter to allocate ASIDs (address space identifiers) for memory domains, but only 255 ASIDs exist. When the counter wraps, two live memory domains can share the same ASID, causing TLB entries to overlap and breaking isolation. This allows a user-mode thread in one domain to read and write memory in another domain, violating memory protection boundaries. The flaw affects Zephyr versions >=3.3.0 <4.3.2 and >=4.4.0 <4.5.0. It is fixed in versions 4.3.2 and 4.5.0 by scanning live domains to avoid ASID reuse and failing domain creation if no ASIDs are free.
CVE-2026-19571 is a race condition vulnerability in the Zephyr project's ITE IT8xxx2 SHI host-command backend. It arises from copying the host-command request header into a shared buffer before validating its length, allowing an attacker controlling the SPI bus to cause out-of-bounds reads or buffer overflows. This can lead to disclosure of embedded-controller memory or controller faults. The vulnerability requires the ability to drive the inter-processor SHI bus and winning a timing race. Fixed in Zephyr versions 4.3.2 and 4.5.0.
CVE-2026-19570 is a memory safety vulnerability in the Zephyr project's Bluetooth LE Audio Broadcast Sink implementation. It arises from unchecked copying of subgroup metadata from a received Basic Audio Announcement (BASE) into a fixed-size static structure, allowing an attacker in radio range to cause memory corruption by sending crafted broadcast data. This can lead to remote code execution in the Bluetooth RX thread without requiring pairing or bonding. The issue affects Zephyr versions from 3.6.0 up to but not including 4.5.0. A fix is available in version 4.5.0 that rejects oversized subgroup data and prevents out-of-bounds copying.
CVE-2026-15894 is a high-severity memory safety vulnerability in the Zephyr Bluetooth Mesh On-Demand Private Proxy solicitation handler. It involves copying a Solicitation PDU into a fixed 17-byte stack buffer without proper length bounds, allowing an attacker to overwrite the stack with attacker-controlled data. This flaw can be triggered remotely by sending crafted BLE advertisements without requiring pairing or authentication. The vulnerability can lead to remote code execution or denial of service. Fixed versions 4.3.2 and 4.4.2 address this issue by enforcing length checks before processing.
CVE-2026-19186 is an integer overflow vulnerability in the Zephyr project's IEEE 802.15.4 network layer when the experimental security option is enabled. The flaw arises from improper length checks before subtracting header and authentication tag lengths from the payload length, causing an underflow that leads to out-of-bounds memory read and write during decryption. This can corrupt adjacent memory and cause denial of service. The vulnerability affects Zephyr versions from 3.2.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.5.0. Fixed versions are 4.3.2 and 4.5.0.
CVE-2026-19185 is a memory-safety vulnerability in the Zephyr project affecting the I3C controller driver subsystem when built with CONFIG_USERSPACE. The flaw allows an unprivileged user-mode thread with access to the I3C controller device to cause out-of-bounds kernel memory writes or disclosures by manipulating target payload data pointers in direct CCC commands. This breaks the intended user-kernel isolation and can lead to privilege escalation. The issue is fixed in Zephyr versions 4.3.2 and 4.5.0.
CVE-2026-19184 is a high-severity vulnerability in the NXP GAU ADC driver of the Zephyr project. The driver incorrectly validates a buffer size expressed in bytes against the number of active ADC channels, which leads to an out-of-bounds write when the buffer is undersized. This can cause kernel memory corruption, crashes, or privilege escalation when user-mode threads with ADC device access submit deliberately undersized buffers. The issue affects Zephyr versions from 3.7.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.5.0. The flaw is fixed in versions 4.3.2 and 4.5.0 by correcting the buffer validation and write logic.
CVE-2026-17053 is a vulnerability in the Zephyr project's SMBus driver where two removal syscalls for SMBALERT and Host Notify callbacks were improperly exposed to user mode. This allows an unprivileged user-mode thread with SMBus device access to unregister callbacks registered by supervisor-mode components, disabling alert handling or causing kernel faults. The issue affects builds with user space enabled and specific SMBus drivers. The vulnerability is fixed by removing these syscalls and restricting callback manipulation to supervisor mode only.
CVE-2026-18747 is an integer overflow vulnerability in the Zephyr project's MCUmgr SMP-over-console transport. It arises from improper handling of packet length fields during base64 frame decoding, leading to an underflow and an inflated buffer length. This allows out-of-bounds reads and potential denial of service or memory disclosure via unauthenticated console input. The flaw affects Zephyr versions from 1.11.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.4.2. A fix is available in versions 4.3.2 and 4.4.2 that rejects packet lengths of two bytes or fewer to prevent underflow.
CVE-2026-18746 is a memory-safety vulnerability in the Zephyr project's LwM2M message handling code. It occurs when processing inbound CoAP WRITE/CREATE requests with a Block1 option, leading to a NULL pointer dereference and device crash. The flaw allows an attacker to cause a fatal memory fault by initiating multiple incomplete block-wise writes, potentially crashing or resetting the device. The vulnerability does not affect confidentiality or integrity. It is fixed in Zephyr versions 4.3.2 and 4.5.0.
CVE-2026-18417 is a memory-safety vulnerability in the Zephyr project's native BSD-socket layer affecting versions 4.3.0 up to but not including 4.4.2. The issue arises from improper handling of asynchronous socket errors by storing error codes in a field expected to hold a pointer, leading to wild-pointer dereferences during repeated network interface down events. This results in a kernel fatal error causing denial of service (device crash or reset) but does not allow attacker-controlled memory corruption. The vulnerability requires an attacker to repeatedly cause link-down events, such as disrupting a wireless link or having local/physical access. Later versions fix this by separating error storage from the user_data field and preventing stale error propagation.
CVE-2026-18416 is a low-severity vulnerability in the Zephyr project CoAP server subsystem. It involves a bounds over-read in the match_path_uri() function when comparing a registered resource path against a URI in a Uri-Query href= option. The flaw causes reading past the end of the option value buffer, leading to undefined behavior but no information disclosure or matching errors. The issue affects Zephyr versions from 1.8.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.4.2. Fixed versions are 4.3.2 and 4.4.2.
CVE-2026-18415 is a vulnerability in the Zephyr project affecting the ieee802154_send() function, where an unchecked buffer copy can cause an out-of-bounds write to a fixed 125-byte transmit buffer. This occurs when sending packets via NET_AF_PACKET sockets bound to an 802.15.4 interface, allowing an application to trigger memory corruption. The issue is mitigated for NET_AF_INET6 packets by fragmentation checks but remains exploitable through raw or datagram sockets. The vulnerability can lead to kernel memory corruption, crashes, or further compromise. Fixed in Zephyr versions 4.3.2 and 4.4.2 by adding proper length validation and safer buffer copying.
CVE-2026-18414 is a vulnerability in the Zephyr project's ADC MAX32 driver where the driver fails to properly validate the buffer size for ADC sampling sequences. This flaw allows a user-mode thread with access to the MAX32 ADC device to cause a buffer overflow by making the driver write more data than the buffer can hold. The overflow occurs because the driver compares the buffer size in bytes against a sample count without accounting for the size of each sample (uint16_t), leading to writes beyond the buffer boundary. This results in kernel memory corruption, potentially enabling privilege escalation or denial of service. The issue affects Zephyr versions >=4.0.0 <4.3.2 and >=4.4.0 <4.4.2 and is fixed in versions 4.3.2 and 4.4.2.
CVE-2026-18413 is a vulnerability in the Zephyr project's NXP MCUX LPADC driver where the driver fails to check if the destination buffer is large enough before writing ADC samples. This can lead to kernel memory corruption when an unprivileged user-mode thread requests more samples than the buffer can hold, potentially enabling privilege escalation or denial of service. The issue affects Zephyr versions >=2.5.0 <4.3.2 and >=4.4.0 <4.4.2 and has been fixed in versions 4.3.2 and 4.4.2.
CVE-2026-16513 is a memory-safety vulnerability in the Zephyr RTOS affecting the userspace verifier function z_vrfy_rtio_sqe_copy_in_get_handles(). It allows a user-mode thread with access to an RTIO kernel object to perform a write-what-where operation by storing a kernel address through a pointer taken directly from user mode without proper write permission checks. This can lead to kernel memory corruption, including overwriting kernel function pointers or thread structures, enabling privilege escalation from user mode to kernel mode. The flaw affects Zephyr versions from 3.4.0 up to but not including 4.3.2 and from 4.4.0 up to but not including 4.4.2. The issue is fixed in versions 4.3.2 and 4.4.2 by adding proper memory write validation before the vulnerable operation.
CVE-2026-17054 is a vulnerability in the Espressif ESP-hosted Wi-Fi driver within the Zephyr project. It involves improper bounds checking of a 16-bit TLV data_length field parsed from SPI frames, leading to out-of-bounds reads of up to approximately 62 KB past a stack object. This can cause device faults and denial of service due to heap allocations and thread blocking. The vulnerability affects Zephyr versions from 4.2.0 up to but not including 4.4.2. The impact is limited to denial of service without data disclosure. There is no indication of an official patch or vendor advisory in the provided data.
CVE-2026-15890 is a medium severity vulnerability in the Zephyr project affecting versions 4.0.0 up to but not including 4.4.2. It involves a race condition in the default AEAD nonce provider for the PSA Internal Trusted Storage (ITS) transform module, where nonce counters are stored in unsynchronized static variables. Concurrent writes to the same UID can cause nonce reuse with AES-GCM or ChaCha20-Poly1305 encryption, leading to catastrophic cryptographic failures such as plaintext leakage and authentication key exposure. The vulnerability requires an application writing concurrently to the same UID from multiple threads and the presence of raw storage access to exploit. The fix involves serializing nonce generation with a mutex to prevent race conditions.