Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: zephyrproject zephyr 4.3.2, 4.5.0 Clear all filters
TI-2026-78937 CVE-2026-79976

NULL pointer dereference in Zephyr MCTP I2C+GPIO target binding

Priority LOW 31

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes.

CVSS 3.1HIGH 7.1 Adjacent network No auth No interaction EPSS 0.0029 Published 2026-10-21 Fixed in 4.3.2, 4.5.0 CWE-476
TI-2026-78934 CVE-2026-78117

Race condition in Zephyr PSOC 6 BLESS driver leaks adjacent memory

Priority LOW 19

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt.

CVSS 3.1MEDIUM 4.2 Adjacent network No auth No interaction EPSS 0.0016 Published 2026-10-21 Fixed in 4.3.2, 4.5.0 CWE-362
TI-2026-78930 CVE-2026-18748

Out-of-bounds read in Zephyr Bluetooth Classic A2DP codec handling

Priority LOW 16

The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array.

CVSS 3.1LOW 3.5 Adjacent network Low privileges No interaction EPSS 0.00203 Published 2026-10-21 Fixed in 4.3.2, 4.5.0 CWE-125
TI-2026-78933 CVE-2026-78116

Double free in the Zephyr Broadcom AFBR-S50 sensor driver

Priority LOW 23

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails.

CVSS 3.1MEDIUM 5.2 Physical No auth No interaction EPSS 0.00206 Published 2026-10-21 Fixed in 4.3.2, 4.5.0 CWE-415
TI-2026-78931 CVE-2026-19676

Zephyr PECI transfer lets user code reach kernel memory

Priority LOW 35

The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00199 Published 2026-10-21 Fixed in 4.3.2, 4.5.0 CWE-822