Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: zephyrproject zephyr 4.5.0 Clear all filters
TI-2026-84252 CVE-2026-85033

Incomplete cleanup in Zephyr AVRCP Target leaves stale vendor responses

Priority LOW 21

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index (get_avrcp_tg()), with the per-transfer context (t…

CVSS 3.1MEDIUM 4.6 Adjacent network Low privileges No interaction EPSS 0.00215 Published 2026-11-03 Fixed in 4.5.0 CWE-459
TI-2026-84251 CVE-2026-85032

Use-after-free in Zephyr MCTP over USB binding during class disable

Priority LOW 21

The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueue runs mctp_usb_class_out_work(), which parses host OUT data byte by byte and fills a packet buffer…

CVSS 3.1MEDIUM 4.8 Physical No auth No interaction EPSS 0.00181 Published 2026-11-03 Fixed in 4.5.0 CWE-416