CVE-2026-14366 is a use-after-free vulnerability in the Silicon Labs SiWx917 WiFi driver within the Zephyr project. The driver incorrectly frees a network packet it does not own during transmission, leading to use-after-free and double free conditions. This can cause memory corruption in the kernel networking buffer pool, resulting in transmit hangs and crashes. The flaw is triggered by normal network transmissions over the affected WiFi interface and can be induced by an adjacent attacker on the same WiFi network. The issue is fixed by removing the erroneous packet unreference call in the driver.
Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose payload was exactly 16 bytes (an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive) was accepted and returned immediately, before wg_decrypt_packet() was ever called. The Poly1305 authentication tag was therefore never verified; the only preceding gates were a cleartext receiver-index lookup (get_peer_keypair_for_index() on the attacker-supplied data_hdr->receiver) and a non-cryptographic keypair validity/expiry check.
The path is reachable entirely from the network: inbound UDP on the WireGuard port is dispatched by wg_input() to handle_transport_data() and then wg_process_data_message(). The 32-bit receiver index is transmitted in cleartext in WireGuard handshake and data messages, so an on-path observer learns it directly and an off-path attacker can brute-force it against the UDP port. Given an active receiving-valid session for that index, an attacker could send a 16-byte garbage payload and have it accepted without possessing the session key.
On acceptance the unauthenticated message caused the management layer to observe a spoofed NET_EVENT_VPN_CONNECTED signal (setting peer->first_valid and notifying any net_mgmt listener) and incremented the keepalive-RX statistic. The impact is limited to integrity of this status signal: no plaintext is decrypted or injected, no key is disclosed, and the early-return path did not update the peer endpoint or liveness timers, so there is no traffic-injection, session-takeover, or availability consequence.
The fix removes the pre-decrypt early return so a 16-byte payload flows through wg_decrypt_packet(), which verifies the Poly1305 tag over the empty plaintext, followed by the existing anti-replay check; only an authenticated, non-replayed message is then recognised as a keepalive. Forged keepalives now fail the tag check and are counted as decrypt failures.
Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE_TRANSPORT_DATA packet succeeded, the code committed several peer-state changes — update_peer_addr() (endpoint roaming update), the keypair->last_rx/peer->last_rx liveness timers, and keypair_update() (promote next→current and destroy the previous keypair) — and only afterward called wg_check_replay(). On a replayed packet the replay check returned -EINVAL, but none of the preceding mutations were rolled back.
The AEAD tag authenticates content but not freshness, so a replayed-but-authentic transport packet decrypts correctly. An attacker who captures one valid ciphertext off the wire (an on-path or shared-medium observer) can re-inject it from an arbitrary spoofed source address. Reaching the handler requires no credentials: it is driven directly from inbound UDP datagrams via the dispatch in subsys/net/lib/wireguard/wg.c.
Because the state mutations committed before the replay check, the replay repoints the peer endpoint to the attacker-chosen source address (roaming hijack), redirecting the victim's subsequent outbound tunnel traffic until the legitimate peer's next packet re-corrects it; it also prematurely destroys the previous keypair and refreshes the RX liveness timer. The tunnel payload stays encrypted under the session keypair, so this is an integrity/availability impact (traffic redirection and session disruption), not payload disclosure. The fix moves wg_check_replay() to immediately after a successful decrypt, before any peer-state mutation, matching the WireGuard specification and the Linux reference implementation.
CVE-2026-13481 is a vulnerability in the Zephyr project's IEEE 1588 PTP management-message parser. It mishandles the PTP_MGMT_TIME management ID by not validating the length of the TLV data before reading and writing a 10-byte timestamp structure. This can cause an out-of-bounds read and in-place corruption of the parsed timestamp within the message buffer. The flaw allows an adjacent attacker on the local PTP segment to send a crafted message that triggers this behavior. The impact is limited to minor information exposure and corruption of the device's parsed management TIME value without causing crashes or broader memory corruption. The issue is fixed in Zephyr versions 4.3.2 and 4.4.2.
CVE-2026-13480 is a low-severity vulnerability in the Zephyr project's LoRaWAN TS004 Fragmented Data Block Transport handler. It involves an out-of-bounds read due to insufficient validation of payload length before accessing data structures during downlink command parsing. The flaw requires possession of the device's session keys and results in limited confidentiality impact without enabling code execution or memory corruption.
CVE-2026-13479 is a low-severity vulnerability in the Zephyr project's LoRaWAN clock-synchronization service. The vulnerability involves a bounds over-read in the clock_sync_package_callback() function when processing the AppTimeAns command. This over-read can cause the device to apply a garbage time correction to its own clock offset. The flaw requires a valid downlink frame that passes integrity checks and decryption, limiting the attacker to a malicious or compromised network/application server or someone with session keys. The issue does not cause crashes or data disclosure and has been fixed in versions 4.3.2 and 4.4.2.
CVE-2026-13478 is a vulnerability in the Zephyr ext2 filesystem driver where an oversized block count in a crafted ext2 image causes an out-of-bounds read during mount. This leads to a large memory read beyond the bitmap buffer, resulting in a denial of service by crashing the system. The issue is triggered by mounting attacker-controlled ext2 media. The vulnerability is fixed in Zephyr versions 4.3.2 and 4.4.2.
CVE-2026-13217 is a memory-safety vulnerability in the Zephyr project's OCPP 1.6 client. It involves improper handling of the uid field in CALLRESULT messages, leading to a NULL pointer dereference when parsing malformed server-supplied input. This can cause a remote denial of service on platforms that trap NULL pointer accesses. The flaw is network-exploitable without authentication beyond the existing server connection or a man-in-the-middle position. A partial fix exists but does not fully address all NULL dereference cases. Versions 4.3.0 through before 4.3.2 and 4.4.0 through before 4.4.2 are affected.
CVE-2026-13216 is a vulnerability in the Zephyr project's virtio PCI driver where improper validation of a device-supplied capability length allows out-of-bounds stack writes during driver initialization. This can lead to kernel stack corruption and potential code execution or system crashes when an untrusted virtio PCIe device is present. The issue is fixed in Zephyr versions 4.3.2 and 4.4.2 by adding proper runtime range checks on the capability length.
CVE-2026-13215 is a vulnerability in the Zephyr ext2 filesystem driver where the s_log_block_size field from the on-disk superblock is not properly validated during mounting. This allows an attacker to supply a crafted ext2 image that causes an out-of-bounds write in kernel memory, potentially leading to denial of service or code execution. The flaw is fixed in Zephyr versions 4.3.2 and 4.4.2.
CVE-2026-13214 is a critical stack buffer overflow vulnerability in the Zephyr project's OCPP 1.6 client. The flaw exists in the parse_getconfig_msg() function, where an unbounded strcpy() copies an attacker-controlled JSON key string into a fixed 50-byte stack buffer. This allows an attacker controlling the central system endpoint or a man-in-the-middle on an unencrypted connection to overflow the stack of the OCPP reader thread remotely. The vulnerability can lead to denial of service or potentially remote code execution depending on build-time protections. It affects Zephyr versions 4.3.0 up to but not including 4.3.2 and 4.4.0 up to but not including 4.4.2. The issue has been fixed in versions 4.3.2 and 4.4.2 by replacing strcpy() with a bounded strncpy() and explicit null termination.
CVE-2026-13213 is a memory-safety vulnerability in the Hearing Access Service (HAS) GATT server of the Zephyr project. It occurs due to a race condition during device boot where security callbacks run before the service is fully registered, leading to NULL pointer dereferences. This can cause a remotely triggerable denial of service (crash) when a previously bonded Bluetooth peer reconnects during this window. The flaw does not lead to memory corruption or information disclosure. Fixed versions 4.3.2 and 4.4.2 address this issue by adding a guard to prevent notifications before service registration.
CVE-2026-13212 is a memory safety vulnerability in the Zephyr project's virtio driver. The driver fails to validate an index (id) provided by the virtio device into internal callback arrays, allowing out-of-bounds access. A malicious or compromised virtio backend can exploit this to cause an arbitrary function pointer call in the guest context, potentially leading to code execution or a crash. This affects Zephyr versions 4.2.0 up to but not including 4.3.2, and 4.4.0 up to but not including 4.4.2. The issue is fixed in versions 4.3.2 and 4.4.2.
The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and make_function_block_info() populate only the first two words (res.data[0] and res.data[1]) and, before this fix, declared their result as an uninitialised local (struct midi_ump res;). The remaining two words (res.data[2], res.data[3]) retain stale stack contents.
Endpoint Info and Function Block Info notifications are UMP Stream messages (UMP_MT_UMP_STREAM), which are 4 words long, so the full 16-byte packet — including the two uninitialised words — is transmitted verbatim by cfg->send(). The responder is driven by attacker-supplied UMP Stream Endpoint-Discovery / Function-Block-Discovery requests via ump_stream_respond(). In the in-tree Network MIDI 2.0 server (subsys/net/lib/midi2/netmidi2.c) these requests arrive as UDP datagrams and, with the default no-authentication endpoint, a remote peer can establish a session and trigger the responses; the same library also serves USB MIDI 2.0 hosts.
Each discovery request causes the device to disclose 8 bytes of its own uninitialised stack memory to the peer, and the request is freely repeatable. This is a confidentiality-only information leak (root cause is use of an uninitialised variable, CWE-457/CWE-908); the leaked words could include residual data or pointer values. There is no memory-corruption, integrity, or availability impact.
The fix zero-initialises both result structs (struct midi_ump res = {0};), so the trailing words are cleared before transmission. These are the only two responder builders that left trailing words unset (send_string() already zeroes its buffer), so the leak is fully closed.
CVE-2026-12999 is a denial-of-service vulnerability in the Infineon Airoc Wi-Fi driver of the Zephyr project. The driver leaks network buffers on transmit failures, eventually exhausting a fixed buffer pool. This causes both transmit and receive operations to fail, resulting in permanent Wi-Fi connectivity loss until the device is rebooted. The issue affects Zephyr versions from 3.6.0 up to but not including 4.3.2 and from 4.4.0 up to but not including 4.4.2. A fix is available in versions 4.3.2 and 4.4.2.
CVE-2026-12634 is a medium severity vulnerability in the Zephyr project's settings subsystem. It involves an out-of-bounds write of a single NUL byte past a fixed 74-byte stack buffer when reading stored setting-name entries from the NVS backend. This occurs because the length returned by nvs_read() can exceed the buffer size, leading to a stack corruption that can cause a crash or denial of service. Exploitation requires an attacker with the ability to write directly to the flash backing the settings partition, such as through a malicious image or physical access. The vulnerability does not impact confidentiality and is not reachable via the network. Fixed in Zephyr versions 4.3.2 and 4.5.0.
CVE-2026-12522 is a high-severity vulnerability in the Zephyr project's HL7800 cellular modem driver. It involves a stack-based buffer overflow caused by improper bounds checking of network-supplied PDP-context parameters in the +CGCONTRDP response handler. A malicious cellular network can send crafted responses with overlong address fields, leading to out-of-bounds writes on the modem worker thread's stack. This can cause remote crashes or potentially allow control-flow hijacking without requiring device privileges or user interaction. The issue is fixed in Zephyr versions 4.3.2 and 4.4.2 by bounding field lengths before copying.
CVE-2026-12633 is a memory safety vulnerability in the Zephyr project's IPv6 neighbor-discovery code. It arises from improper bounds checking of the 6LoWPAN Context Option (6CO) context_len field in ICMPv6 Router Advertisements, leading to an out-of-bounds memset that can overwrite kernel memory. This flaw can be triggered remotely by an unauthenticated attacker on the same local network segment, causing a denial of service through memory corruption. The issue affects Zephyr versions from 1.8.0 up to but not including 4.3.2, and from 4.4.0 up to but not including 4.4.2. Fixed versions are 4.3.2 and 4.4.2.
CVE-2026-12632 is a vulnerability in Zephyr's Precision Time Protocol (PTP) receive handler where an out-of-bounds read occurs due to improper indexing of a message size table. This flaw allows an attacker on the same network link to cause a denial of service by sending crafted PTP messages with invalid type values. The issue is fixed in Zephyr versions 4.3.2 and 4.4.2.
CVE-2026-12631 is a vulnerability in the Zephyr kernel affecting the k_thread_join() and k_thread_abort() system calls. Due to improper validation logic, an unprivileged user-mode thread can cause a kernel crash or potentially bypass access controls. The flaw arises from incorrect error handling that prevents the kernel from raising an expected exception on access denial. This leads to either a denial of service via an illegal instruction trap on Clang builds or undefined behavior on GCC builds. The issue is fixed in Zephyr versions 4.3.2 and 4.4.2.