Vulnerabilities

TI-2026-11404 CVE-2026-13478

Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count

LOW 24

The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_first_data_block to ext2_bitmap_count_set().

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00143 Published 2026-08-25 Fixed in 4.3.2, 4.4.2 CWE-125

TI-2026-11223 CVE-2026-13217

NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi

LOW 28

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00667 Published 2026-08-25 Fixed in 4.3.2, 4.4.2 CWE-476

TI-2026-11222 CVE-2026-13216

Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length

LOW 29

The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization.

CVSS 3.1MEDIUM 6.1 Physical No auth No interaction EPSS 0.00257 Published 2026-08-25 Fixed in 4.3.2, 4.4.2 CWE-787

TI-2026-11221 CVE-2026-13215

Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image

LOW 32

The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem.

CVSS 3.1MEDIUM 6.8 Physical No auth No interaction EPSS 0.00278 Published 2026-08-25 Fixed in 4.3.2, 4.4.2 CWE-787

TI-2026-11220 CVE-2026-13214

Stack buffer overflow in OCPP GetConfiguration key parsing

MEDIUM 51

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.009 Published 2026-08-25 Fixed in 4.3.2, 4.4.2 CWE-787