Zephyrproject: >> Zephyr >> 1.14.0 Security Vulnerabilities
Parameters are not validated or sanitized, and are later used in various internal operations.
CVSS Score
7.6
EPSS Score
0.0
Published
2025-09-19
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.
CVSS Score
7.6
EPSS Score
0.0
Published
2025-09-19
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.
CVSS Score
7.1
EPSS Score
0.0
Published
2025-09-19
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.
CVSS Score
4.3
EPSS Score
0.0
Published
2025-09-19
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data.
CVSS Score
8.2
EPSS Score
0.002
Published
2025-02-25
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
CVSS Score
8.2
EPSS Score
0.001
Published
2025-02-25
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
CVSS Score
8.2
EPSS Score
0.003
Published
2025-02-25
No proper validation of the length of user input in http_server_get_content_type_from_extension.
CVSS Score
8.6
EPSS Score
0.002
Published
2025-02-03
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
CVSS Score
7.5
EPSS Score
0.003
Published
2024-12-16
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
CVSS Score
9.3
EPSS Score
0.0
Published
2024-11-15
Page 1