Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: zephyrproject zephyr 4.3.2, 4.5.0 Clear all filters
TI-2026-74324 CVE-2026-75085

Out-of-bounds read from frame length underflow in Zephyr STM32WBA driver

Priority LOW 19

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without first checking that the radio-rep…

CVSS 3.1MEDIUM 4.2 Adjacent network No auth No interaction EPSS 0.00205 Published 2026-10-14 Fixed in 4.3.2, 4.5.0 CWE-125
TI-2026-74323 CVE-2026-75084

Zephyr CC1200 driver out-of-bounds write from unchecked packet length

Priority LOW 30

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity() (drivers/ieee802154/ieee802154_cc1200.c).

CVSS 3.1MEDIUM 6.8 Adjacent network No auth No interaction EPSS 0.00286 Published 2026-10-14 Fixed in 4.3.2, 4.5.0 CWE-787
TI-2026-74322 CVE-2026-75083

Integer underflow in NXP KW41Z driver causes out-of-bounds write in Zephyr

Priority LOW 26

The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c, computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t, where len is the frame length repor…

CVSS 3.1MEDIUM 5.9 Adjacent network No auth No interaction EPSS 0.00229 Published 2026-10-14 Fixed in 4.3.2, 4.5.0 CWE-191