Vulnerabilities

TI-2026-10823 CVE-2026-12632

Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type

LOW 29

Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp_msg_type() (msg->header.type_major_sdo_id & 0xF, range 0-15) and…

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00285 Published 2026-08-18 Fixed in 4.3.2, 4.4.2 CWE-125

TI-2026-10822 CVE-2026-12631

Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel

LOW 28

The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate() in kernel/thread.c.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00155 Published 2026-08-18 Fixed in 4.3.2, 4.4.2 CWE-862

TI-2026-10745 CVE-2026-12520

Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers

LOW 28

The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier) parses AT responses with roughly twenty handlers that call net_buf_line…

CVSS 3.1MEDIUM 6.4 Adjacent network No auth No interaction EPSS 0.0029 Published 2026-08-18 Fixed in 4.3.2, 4.4.2 CWE-787

Vulnerabilities

Filters

Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type

Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel

Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers