Description Summary:
A memory safety vulnerability in the Zephyr RTOS flash_copy system call allows local attackers to achieve unauthorized memory access.

Executive Summary:
A critical memory safety vulnerability in the Zephyr RTOS flash_copy system call could allow a local attacker to achieve elevated privileges or compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-9771

Affected Software: zephyrproject zephyr

Affected Versions: 4.0.0 up to (excluding) 4.4.2

Vulnerability: The vulnerability exists within the implementation of the flash_copy system call, specifically in the verification logic handled by z_vrfy_flash_copy. This flaw allows a local, authenticated user to bypass intended memory protections.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to embedded systems running the Zephyr RTOS. Unauthorized access to flash memory can result in complete system compromise, firmware tampering, or the exposure of sensitive data stored on the device.

Remediation Plan

Immediate Action: Update the Zephyr RTOS to version 4.4.2 or later to include the necessary security fixes for the flash_copy system call.

Proactive Monitoring: Implement strict access control lists for local system users and monitor for unauthorized attempts to access low-level system calls or memory-mapped flash regions.

Compensating Controls: If an update cannot be applied immediately, restrict access to the device to only trusted local users and disable unnecessary system calls if the hardware configuration permits.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access, which limits the immediate threat from remote attackers.

Analyst Recommendation

Given the critical nature of memory safety flaws in an RTOS, immediate patching is essential to prevent potential full-system compromise. Development teams should prioritize upgrading the Zephyr kernel version to 4.4.2 to ensure the integrity of the flash subsystem.

Description Summary:
A bounds checking error in the Zephyr RTOS TLS subsystem allows local authenticated attackers to cause potential memory corruption or system instability.

Executive Summary:
A critical bounds checking vulnerability in the Zephyr RTOS TLS subsystem could allow local attackers to disrupt system operations or potentially achieve unauthorized effects.

Vulnerability Details

CVE-ID: CVE-2026-8718

Affected Software: Zephyr RTOS

Affected Versions: 3.5.0 up to (excluding) 4.4.1

Vulnerability: This is a bounds checking error (CWE-787) located within the tls_opt_dtls_peer_connection_id_value_get function in the Zephyr network subsystem. An attacker with local access can exploit this flaw to trigger memory corruption, which may lead to system crashes or further unauthorized behavior.

Business Impact

Exploitation of this flaw could result in the denial of service for critical embedded systems or potentially allow for unauthorized memory access. Given the CVSS score of 8.4, the risk to system stability and integrity is high, especially for devices running in sensitive or mission-critical environments.

Remediation Plan

Immediate Action: Update the Zephyr RTOS codebase to version 4.4.1 or later to incorporate the necessary bounds checking fixes.

Proactive Monitoring: Monitor system logs for unexpected reboots, kernel panics, or memory-related errors that may indicate an attempt to exploit this vulnerability.

Compensating Controls: Limit local access to the device and ensure that all network-facing services are hardened and kept to the minimum required for operation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly technical and requires local access, but it remains a significant risk for embedded platforms.

Analyst Recommendation

Due to the nature of the vulnerability within the core networking subsystem of Zephyr, all users are urged to update to the latest patched version of the RTOS. Prioritizing this update is essential for maintaining the stability and security of embedded deployments.

Description Summary:
A directory traversal or unauthorized file access vulnerability exists within the Zephyr HTTP server when using the static-filesystem resource type.

Executive Summary:
The Zephyr HTTP server contains a high-severity vulnerability that allows unauthorized access to files, potentially exposing sensitive system information.

Vulnerability Details

CVE-ID: CVE-2026-8023

Affected Software: Zephyr Project Zephyr RTOS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The HTTP server implementation in the Zephyr RTOS, specifically the static-filesystem resource type, fails to properly restrict access when CONFIG_FILE_SYSTEM is enabled. This allows unauthenticated remote attackers to potentially read files outside the intended root directory.

Business Impact

A CVSS score of 7.5 highlights the severity of this unauthorized access vulnerability. In an embedded context, this could lead to the exposure of sensitive configuration files, credentials, or proprietary data, significantly increasing the risk of full device compromise and loss of operational control.

Remediation Plan

Immediate Action: Apply the vendor-provided patch to the Zephyr RTOS source code or update to a version where this file access path is properly restricted.

Proactive Monitoring: Monitor network traffic for suspicious HTTP requests targeting sensitive file paths or using directory traversal sequences.

Compensating Controls: If patching is delayed, disable the CONFIG_FILE_SYSTEM feature in the HTTP server configuration if it is not strictly required for current operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for exploitation is high due to the nature of the file access flaw in an RTOS environment.

Analyst Recommendation

This vulnerability represents a significant security risk for embedded systems running Zephyr. Engineering teams must review their firmware configurations and apply the necessary patches immediately to prevent unauthorized access to the underlying filesystem.

Description Summary:
The IPv6 Neighbor Discovery handlers in the Zephyr RTOS contain a vulnerability that may lead to memory corruption or instability.

Executive Summary:
A critical vulnerability in the Zephyr RTOS IPv6 stack could allow for remote memory corruption, potentially leading to unauthorized code execution or system crashes.

Vulnerability Details

CVE-ID: CVE-2026-7656

Affected Software: Zephyr Project Zephyr

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the IPv6 Neighbor Discovery handlers within the networking subsystem. It involves improper handling of packet data, which can be exploited by an unauthenticated remote attacker via crafted IPv6 traffic.

Business Impact

With a CVSS score of 8.1, this vulnerability poses a severe risk to embedded systems and IoT devices running Zephyr. Exploitation could allow attackers to bypass security boundaries, crash critical infrastructure, or achieve remote code execution, leading to full device compromise.

Remediation Plan

Immediate Action: Update the Zephyr RTOS codebase to the latest version incorporating the fix for the IPv6 Neighbor Discovery handler vulnerability.

Proactive Monitoring: Monitor network traffic for malformed IPv6 Neighbor Discovery packets or unusual protocol behavior within the network stack.

Compensating Controls: If patching is not immediately feasible, restrict inbound IPv6 traffic to only known, trusted sources and utilize internal network segmentation to isolate vulnerable devices.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Embedded systems are often difficult to patch, but the risk associated with this network-level vulnerability is significant. Organizations must prioritize updating their Zephyr-based firmware to prevent potential remote exploitation of their connected devices.

Description Summary:
A stack-based buffer overflow in the OCPP 1.6 client of the Zephyr RTOS allows remote attackers to cause a denial of service or potentially execute arbitrary code via a crafted message.

Executive Summary:
A critical stack buffer overflow vulnerability in the Zephyr RTOS OCPP 1.6 client could allow a remote attacker to crash the system or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-13214

Affected Software: zephyrproject zephyr

Affected Versions: 4.3.0 up to (excluding) 4.4.2

Vulnerability: The vulnerability is a memory-safety issue (CWE-787) involving an unbounded strcpy() operation when parsing incoming JSON configuration keys, allowing an attacker to overwrite stack memory.

Business Impact

The potential for remote code execution (RCE) on an embedded system like Zephyr presents a severe security risk, potentially allowing an attacker to gain full control over the device. Given the 9.8 CVSS score, this vulnerability could lead to operational disruption, loss of device integrity, and unauthorized access to the broader network environment in which the device operates.

Remediation Plan

Immediate Action: Update the Zephyr project source code to version 4.4.2 or higher, which includes the fix replacing the unsafe strcpy() with a bounded strncpy() function.

Proactive Monitoring: Monitor network traffic for malformed or unusually large OCPP GetConfiguration messages directed at charge point endpoints.

Compensating Controls: Ensure that communication between charge points and the central system is encrypted and authenticated to prevent man-in-the-middle attackers from injecting malicious payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, involving stack memory corruption, makes it a high-value target for sophisticated threat actors.

Analyst Recommendation

Developers and system integrators must prioritize updating to the patched version of the Zephyr RTOS. Because this is a low-level memory corruption issue, thorough testing of the updated firmware is required to ensure system stability following the security update.

Description Summary:
The Zephyr virtio driver fails to validate the descriptor chain head ID, which may lead to memory corruption when communicating with a virtio device.

Executive Summary:
A memory corruption vulnerability in the Zephyr virtio driver could allow an attacker to cause system instability or gain unauthorized control over the device.

Vulnerability Details

CVE-ID: CVE-2026-13212

Affected Software: zephyrproject zephyr

Affected Versions: 4.2.0 up to (excluding) 4.4.2

Vulnerability: This is a memory safety issue occurring within the virtio driver. The driver does not properly validate the descriptor chain head ID written by the virtio device into the used ring, which can lead to improper memory access.

Business Impact

Successful exploitation of this memory corruption vulnerability can lead to system crashes or arbitrary code execution, depending on the environment. With a CVSS score of 8.8, this flaw poses a substantial risk to systems relying on Zephyr for critical operations, potentially leading to total loss of system integrity or availability.

Remediation Plan

Immediate Action: Update the Zephyr RTOS to version 4.4.2 or higher to include the necessary validation logic for the virtio driver.

Proactive Monitoring: Monitor system logs for unexpected reboots or kernel panics that may indicate memory corruption events.

Compensating Controls: If patching is delayed, isolate affected devices from untrusted network segments to minimize the potential for an attacker to interact with the vulnerable virtio driver.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an implementation error in driver memory handling.

Analyst Recommendation

Given the critical nature of memory corruption vulnerabilities in RTOS environments, developers should prioritize integrating the upstream fix into their firmware builds. Ensuring the system is updated to the latest version is the most effective way to eliminate this risk.

Description Summary:
A buffer overflow vulnerability in the Zephyr HL7800 cellular modem driver allows for potential memory corruption during the processing of AT command responses.

Executive Summary:
A critical memory corruption vulnerability in the Zephyr RTOS HL7800 driver could allow adjacent attackers to trigger system instability or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-12522

Affected Software: Zephyr Project Zephyr

Affected Versions: 2.4.0 up to 4.4.2

Vulnerability: This is a buffer overflow vulnerability (CWE-787) located in the on_cmd_atcmdinfo_ipaddr function. The vulnerability is exploitable by an adjacent attacker (someone on the same network segment) who does not require prior authentication.

Business Impact

The potential for memory corruption in an RTOS environment often results in a complete system crash or arbitrary code execution, which can disrupt critical embedded operations. With a CVSS score of 8.8, this vulnerability represents a high-risk vector for devices utilizing the HL7800 modem driver.

Remediation Plan

Immediate Action: Update the Zephyr project codebase to a version that includes the fix provided in commit a1cbced64181bc0bdf95e1fd7118f2bb70cf679b.

Proactive Monitoring: Monitor network traffic directed toward the modem interface for malformed AT command responses or unexpected communication patterns.

Compensating Controls: If immediate patching is not possible, isolate affected devices from untrusted network segments to mitigate the risk of adjacent exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it highly susceptible to exploitation if the modem interface is exposed to a hostile network environment.

Analyst Recommendation

Given the potential for remote code execution in embedded systems, this update should be treated with high urgency. Developers must integrate the provided security patch into their firmware build pipeline immediately to secure the device communication stack.

Description Summary:
A use-after-free vulnerability exists in the Zephyr RTOS dynamic kernel-object disposal path, specifically within the unref_check function in the userspace kernel component.

Executive Summary:
A high-severity use-after-free vulnerability in the Zephyr RTOS kernel could allow a local authenticated attacker to achieve total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-12366

Affected Software: Zephyr Project Zephyr

Affected Versions: 1.12.0 up to (excluding) 4.5.0

Vulnerability: The flaw (CWE-416) resides in the dynamic kernel-object disposal path of the Zephyr kernel. An attacker with low-level local privileges can trigger this use-after-free condition to gain unauthorized control over kernel memory structures.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to systems utilizing the Zephyr RTOS. Exploitation could lead to arbitrary code execution within the kernel, resulting in total system failure, data corruption, or the bypass of security boundaries designed to protect the runtime environment.

Remediation Plan

Immediate Action: Update the Zephyr RTOS environment to version 4.5.0 or later, which contains the necessary security patches for the kernel disposal logic.

Proactive Monitoring: Audit local access permissions and monitor for kernel-level crashes or unexpected reboots that may indicate exploitation attempts against the kernel memory management system.

Compensating Controls: Restrict local access to the device and ensure that userspace applications are strictly sandboxed, limiting the ability of low-privileged processes to interact with sensitive kernel-object functions.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The technical nature of this flaw makes it complex to exploit, typically requiring deep knowledge of the target system architecture.

Analyst Recommendation

Given the potential for complete system control, the security update for the Zephyr kernel should be applied as part of the next scheduled maintenance window. Ensuring that the RTOS is running the latest patched version is essential for maintaining device security in embedded and IoT deployments.

Description Summary:
The user-space system-call verifier in Zephyr RTOS contains a memory-safety vulnerability in the logging subsystem.

Executive Summary:
A memory-safety vulnerability in the Zephyr RTOS logging subsystem allows for potential privilege escalation or system instability.

Vulnerability Details

CVE-ID: CVE-2026-12364

Affected Software: zephyrproject zephyr

Affected Versions: 2.6.0 up to (excluding) 4.4.2

Vulnerability: The system-call verifier z_vrfy_z_log_msg_static_create within the logging subsystem fails to enforce proper memory safety constraints. This vulnerability is exploitable by an authenticated user with low privileges.

Business Impact

Exploitation of this memory-safety flaw could allow a local attacker to bypass system-call protections, leading to information disclosure or a denial-of-service condition. Given the CVSS score of 8.4, the vulnerability is high-risk, particularly in environments where Zephyr is deployed in secure or mission-critical embedded systems.

Remediation Plan

Immediate Action: Update the Zephyr RTOS to version 4.4.2 or later to address the vulnerable system-call verifier.

Proactive Monitoring: Monitor system logs for unexpected crashes or error conditions originating from the logging subsystem which may indicate attempted exploitation.

Compensating Controls: Ensure that user-space applications are strictly sandboxed and that system-call interfaces are restricted to the minimum necessary functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is confirmed to be fixed in the upstream repository via commit 77aa26d8b940f39778154f02563caf15d02efdac.

Analyst Recommendation

Given the potential for system-wide impact, organizations using Zephyr should prioritize updating to the patched version. Verify that the build environment incorporates the fix to ensure the integrity of the deployed firmware.

Description Summary:
A memory safety vulnerability in the UpdateHub firmware-update agent within the Zephyr RTOS allows an attacker to cause a denial of service via the probe handler.

Executive Summary:
A memory safety flaw in the Zephyr RTOS UpdateHub agent enables remote unauthenticated attackers to trigger a denial of service condition on affected firmware.

Vulnerability Details

CVE-ID: CVE-2026-11810

Affected Software: Zephyr Project Zephyr

Affected Versions: 3.7.0 up to (excluding) 4.4.2

Vulnerability: The vulnerability exists in the UpdateHub firmware-update agent within the z_impl_updatehub_probe function. It is a memory safety issue (CWE-476) that can be triggered by an unauthenticated remote attacker, resulting in a denial of service.

Business Impact

The ability for a remote attacker to crash the firmware-update agent can result in significant system downtime and operational disruption. With a CVSS score of 7.5, this vulnerability represents a high risk to availability, particularly for critical infrastructure or embedded devices relying on the Zephyr RTOS.

Remediation Plan

Immediate Action: Update the Zephyr project firmware to version 4.4.2 or the latest available patched release to remediate the memory safety vulnerability.

Proactive Monitoring: Monitor device stability and watch for unexpected reboots or service failures in the UpdateHub agent.

Compensating Controls: Implement network-level access controls to restrict access to the firmware-update management interfaces to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Memory safety issues in embedded systems are often targets for stability disruption.

Analyst Recommendation

Given the potential for denial of service in embedded environments, organizations should prioritize updating their Zephyr-based firmware. Ensure that all affected devices are patched to version 4.4.2 to maintain operational continuity.

Description Summary:
A heap-based buffer overflow vulnerability in the Zephyr RTOS hawkBit device management client allows for potential memory corruption during HTTP response processing.

Executive Summary:
A high-severity heap buffer overflow in the Zephyr hawkBit client could allow remote attackers to cause system crashes or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-10849

Affected Software: Zephyr Project Zephyr

Affected Versions: 2.4.0 up to (excluding) 4.5.0

Vulnerability: The hawkBit client fails to safely handle HTTP response bodies within the response_json_cb function, leading to a heap-based buffer overflow (CWE-122, CWE-787). This vulnerability can be triggered by a remote, unauthenticated attacker sending a specially crafted HTTP response to the device.

Business Impact

With a CVSS score of 8.2, this vulnerability represents a significant threat to device stability and security. Exploitation could lead to persistent denial of service or remote code execution on connected IoT devices, potentially compromising the integrity of managed fleets and enabling unauthorized control over embedded systems.

Remediation Plan

Immediate Action: Update the Zephyr RTOS codebase to version 4.5.0 or later to apply the necessary bounds checking for heap allocations.

Proactive Monitoring: Monitor network traffic directed toward the hawkBit client for unusually large or malformed HTTP JSON payloads.

Compensating Controls: Deploy network-level traffic inspection or a firewall to filter and validate incoming traffic from external update servers to the hawkBit management interface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically significant as it resides in a core component of the device management subsystem.

Analyst Recommendation

Given the critical role of the hawkBit client in device management, this update must be treated as a high priority. Organizations utilizing Zephyr RTOS should verify their version and apply the patch to prevent potential remote exploitation of their device fleet.

Description Summary:
A memory bounds error in the OCPP 1 implementation within Zephyr RTOS allows for potential out-of-bounds read or write operations, which may lead to system instability or service disruption.

Executive Summary:
A memory corruption vulnerability in Zephyr RTOS versions 4.3.0 through 4.4.9 poses a significant risk of denial-of-service or unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-10848

Affected Software: Zephyr Project Zephyr RTOS

Affected Versions: 4.3.0 up to (excluding) 4.5.0

Vulnerability: This vulnerability involves out-of-bounds read and write flaws (CWE-125 and CWE-787) within the OCPP 1 stack. The attack vector is network-based and does not require user interaction or prior authentication to trigger.

Business Impact

Successful exploitation of these memory bounds errors can lead to a crash of the affected device or the potential for arbitrary code execution. Given the CVSS score of 7.0, this represents a high-severity risk that could cause critical system downtime in industrial or IoT environments relying on the Zephyr RTOS.

Remediation Plan

Immediate Action: Upgrade to Zephyr RTOS version 4.5.0 or later to incorporate the necessary memory safety fixes.

Proactive Monitoring: Review network traffic and system logs for unexpected behavior or crash events originating from the OCPP interface.

Compensating Controls: Implement network segmentation to restrict access to devices running the affected OCPP service, thereby limiting the exposure to untrusted network segments.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the current data.

Analyst Notes: As of August 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on memory management errors makes it a target for stability-focused attacks, but the requirement for specific network conditions may limit immediate, widespread exploitation.

Analyst Recommendation

Organizations utilizing the Zephyr RTOS should prioritize the migration to version 4.5.0 to address these critical memory bounds vulnerabilities. Given the potential for service disruption, testing and deployment of this patch should be scheduled immediately to ensure the integrity and availability of embedded systems.

Description Summary:
A use-after-free vulnerability in the Zephyr Bluetooth GATT client handler can lead to memory corruption when processing specific responses.

Executive Summary:
A use-after-free vulnerability in the Zephyr RTOS Bluetooth stack allows adjacent attackers to trigger memory corruption or system crashes.

Vulnerability Details

CVE-ID: CVE-2026-10685

Affected Software: Zephyr Project Zephyr

Affected Versions: 2.4.0 up to (excluding) 4.5.0

Vulnerability: A use-after-free vulnerability (CWE-416) exists in the gatt_write_ccc_rsp() function within the Bluetooth host subsystem. An attacker within Bluetooth range can trigger this condition by sending a malformed GATT response, causing the system to interact with freed memory.

Business Impact

The vulnerability poses a risk of system instability, denial of service, or potentially arbitrary code execution on devices running the Zephyr RTOS. Given the nature of embedded systems, this could lead to the total loss of control over connected IoT devices or the compromise of local Bluetooth communications. The CVSS score of 7.6 highlights the urgency of addressing this flaw in connected product ecosystems.

Remediation Plan

Immediate Action: Update the Zephyr RTOS project to version 4.5.0 or later.

Proactive Monitoring: Monitor Bluetooth traffic for unexpected or malformed GATT responses that deviate from standard protocol specifications.

Compensating Controls: Disable Bluetooth functionality if it is not required for the device's operational use case to mitigate the attack vector entirely.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free flaws in low-level Bluetooth stacks are notoriously difficult to exploit but are highly impactful when successful.

Analyst Recommendation

Developers and manufacturers utilizing Zephyr RTOS must integrate the provided security patch immediately. Ensuring the Bluetooth stack is updated is critical for the security of all deployed Zephyr-based hardware.

Description Summary:
Memory safety vulnerabilities in the Zephyr ADIN2111/ADIN1110 Ethernet driver allow for potential memory corruption or unauthorized data access.

Executive Summary:
Memory safety flaws in the Zephyr Ethernet driver expose the system to potential corruption and unauthorized access, necessitating an immediate update to the latest version.

Vulnerability Details

CVE-ID: CVE-2026-10673

Affected Software: zephyrproject zephyr

Affected Versions: 3.7.0 up to (excluding) 4.5.0

Vulnerability: This issue involves memory safety errors (CWE-787, CWE-125) within the ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver. These flaws allow an attacker with adjacent network access to trigger memory corruption or read out-of-bounds memory, which could lead to system instability or arbitrary code execution.

Business Impact

Given the CVSS score of 8.3, this vulnerability poses a significant risk to systems relying on Zephyr for network communications. Exploitation could result in a complete compromise of the embedded device, leading to service disruption or the exfiltration of sensitive data handled by the RTOS.

Remediation Plan

Immediate Action: Update the Zephyr RTOS to version 4.5.0 or later to patch the vulnerable Ethernet driver.

Proactive Monitoring: Monitor network traffic for malformed frames or unexpected behavior in devices utilizing the ADIN2111/ADIN1110 hardware interfaces.

Compensating Controls: Isolate devices using the affected driver to a trusted, restricted network segment to prevent adjacent network attackers from reaching the vulnerable interface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The complexity of these memory safety bugs generally requires deep expertise in embedded systems and driver-level exploitation.

Analyst Recommendation

Due to the existence of a proof-of-concept and the critical nature of memory corruption vulnerabilities in RTOS environments, users must prioritize the transition to Zephyr version 4.5.0. Failure to update leaves devices exposed to network-based attacks that could result in full system takeover.

Description Summary:
A use-after-free vulnerability in the Zephyr RTOS kernel-object tracking mechanism could allow unauthorized operations.

Executive Summary:
A high-severity use-after-free vulnerability exists in the Zephyr RTOS kernel, potentially allowing a local attacker to trigger memory corruption or unauthorized system actions.

Vulnerability Details

CVE-ID: CVE-2026-10667

Affected Software: zephyrproject zephyr

Affected Versions: 1.14.0 up to (excluding) 4.5.0

Vulnerability: The vulnerability is a use-after-free (CWE-416) condition found within the dynamic kernel-object tracking logic, which can be triggered by a local attacker to manipulate kernel-space memory.

Business Impact

With a CVSS score of 7.8, this vulnerability poses a critical risk to systems running the Zephyr RTOS. Successful exploitation could lead to system crashes (DoS) or the potential for privilege escalation, compromising the reliability of embedded or IoT devices.

Remediation Plan

Immediate Action: Review the Zephyr project security advisories and apply the latest kernel updates provided by the project to ensure the fix is implemented.

Proactive Monitoring: Monitor device stability and kernel logs for memory-related errors or unexpected reboots that may indicate exploitation attempts.

Compensating Controls: Implement memory protection features and kernel hardening where supported by the specific hardware platform to limit the impact of memory corruption.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Use-after-free flaws in RTOS kernels are inherently complex and typically require precise timing to exploit.

Analyst Recommendation

Given the critical nature of RTOS kernel vulnerabilities, it is imperative that all developers and administrators running versions of Zephyr prior to 4.5.0 update their codebase immediately. Refer to the official GitHub advisory for specific commit-level remediation details.

Description Summary:
A memory-safety vulnerability in the parse_ipv4() function within the Zephyr RTOS networking stack may allow for potential remote code execution or system instability.

Executive Summary:
A critical memory-safety vulnerability in the Zephyr RTOS networking stack could allow an unauthenticated remote attacker to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-10666

Affected Software: Zephyr Project Zephyr

Affected Versions: 1.9.0 up to (excluding) 4.5.0

Vulnerability: The parse_ipv4() function in subsys/net/ip/utils is susceptible to a memory-safety issue (CWE-787). This allows an unauthenticated attacker to trigger an out-of-bounds write via maliciously crafted network traffic.

Business Impact

As this affects the networking stack of an RTOS, a successful exploit could lead to full system compromise, including remote code execution, denial of service, or unauthorized control of the embedded device. The CVSS score of 8.1 reflects the high potential for impact on connected devices, which are often critical components of industrial or IoT infrastructure.

Remediation Plan

Immediate Action: Upgrade to the latest available version of the Zephyr RTOS (targeted at 4.5.0 or later) as provided by the vendor.

Proactive Monitoring: Monitor network traffic for malformed IPv4 packets that may trigger crashes or unexpected behavior in the network stack.

Compensating Controls: Implement network segmentation and firewall rules to restrict traffic to only known, trusted sources, reducing the attack surface for the networking stack.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Memory-safety flaws in RTOS networking stacks are high-value targets; thus, prompt patching is essential.

Analyst Recommendation

The severity of this memory corruption vulnerability necessitates immediate action, particularly for devices deployed in public-facing or untrusted network environments. Developers should integrate the provided fix commits into their downstream distributions to ensure system security.

Description Summary:
A buffer overflow vulnerability in the WireGuard subsystem of Zephyr RTOS 4.4.0 allows remote attackers to cause potential integrity or availability impacts.

Executive Summary:
A high-severity buffer overflow in the Zephyr RTOS WireGuard subsystem could allow remote attackers to compromise system integrity or availability.

Vulnerability Details

CVE-ID: CVE-2026-10665

Affected Software: zephyrproject zephyr

Affected Versions: 4.4.0 up to (excluding) 4.5.0

Vulnerability: This is a Buffer Overflow (CWE-787) vulnerability located in the wg_process_data_message() function within the WireGuard cryptographic subsystem. An unauthenticated attacker can exploit this via maliciously crafted network packets to cause memory corruption, potentially leading to system instability or arbitrary code execution.

Business Impact

With a CVSS score of 7.4, this vulnerability poses a serious risk to embedded devices running Zephyr RTOS. Because the flaw exists in the network stack, it is remotely exploitable, which could lead to a complete compromise of the device's integrity or result in a Denial of Service (DoS), potentially disrupting critical industrial or IoT operations.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates or backport the fix from the referenced commit to your local Zephyr environment.

Proactive Monitoring: Monitor network traffic for malformed or unexpected WireGuard protocol packets that may indicate an exploitation attempt.

Compensating Controls: If patching is not immediately feasible, isolate devices using Zephyr's WireGuard implementation behind a firewall that inspects and filters traffic to the relevant ports.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack (AC:H) provides a slight barrier, but the impact on integrity and availability remains severe.

Analyst Recommendation

Due to the nature of buffer overflows in kernel-level network stacks, this vulnerability should be treated with high urgency. Developers and system integrators should prioritize updating to the patched version of Zephyr or applying the upstream fix to ensure the robustness of their communication subsystems.

Description Summary:
A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data, leading to potential memory corruption or system crashes.

Executive Summary:
A high-severity vulnerability exists in the Zephyr RTOS Bluetooth Host stack where missing length validation allows unauthenticated attackers to trigger a crash via malformed ISO data.

Vulnerability Details

CVE-ID: CVE-2026-10658

Affected Software: Zephyr Project Zephyr RTOS

Affected Versions: See vendor advisory for affected versions

Vulnerability: The flaw resides in the Bluetooth Host ISO receive path, where the system fails to perform adequate length validation on incoming Host Controller Interface (HCI) ISO data. An unauthenticated attacker can exploit this by sending malformed packets, potentially resulting in memory corruption or a system-wide assertion failure.

Business Impact

With a CVSS score of 7.1, this vulnerability presents a substantial risk to systems utilizing Zephyr RTOS for Bluetooth communication. Successful exploitation results in system instability or denial-of-service, which could compromise the reliability of connected embedded hardware. Impact includes potential service outages and the need for manual device resets.

Remediation Plan

Immediate Action: Apply the vendor-provided patch or upgrade to the latest stable release of Zephyr RTOS that includes the required input validation logic.

Proactive Monitoring: Review system logs for unexpected crashes or error messages related to the Bluetooth Host Controller Interface during data reception.

Compensating Controls: Use a hardware-based Bluetooth controller or firewall to sanitize or drop malformed HCI traffic before it reaches the host software stack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given that this vulnerability affects the core Bluetooth Host communication path, it is imperative that organizations using Zephyr RTOS verify their current version and deploy the latest security updates. Patching is the only effective way to ensure the integrity of the data receive path and prevent exploitation.

Description Summary:
A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in the Zephyr RTOS SDP parser, potentially causing a denial-of-service.

Executive Summary:
A critical vulnerability in the Zephyr RTOS Bluetooth stack allows unauthenticated attackers to trigger a system assertion, resulting in a potential denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-10651

Affected Software: Zephyr Project Zephyr RTOS

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a reachable assertion within the Bluetooth Classic Service Discovery Protocol (SDP) parser. An unauthenticated remote attacker can trigger this condition by sending a specially crafted SDP attribute, causing the affected device to crash.

Business Impact

The exploitation of this flaw leads to a denial-of-service, which can render embedded devices running Zephyr RTOS unresponsive. Given the CVSS score of 7.1, this is a High-severity risk, particularly for critical infrastructure or medical devices that rely on constant availability. Unplanned downtime in these environments could lead to significant operational disruption and safety risks.

Remediation Plan

Immediate Action: Update the Zephyr RTOS codebase to the version specified in the official vendor advisory to incorporate the necessary assertion handling patches.

Proactive Monitoring: Monitor Bluetooth traffic logs for malformed or unexpected SDP attribute packets that deviate from standard protocol specifications.

Compensating Controls: Implement strict Bluetooth perimeter security, such as disabling Bluetooth functionality when not required or restricting pairing to trusted devices only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on the Bluetooth stack in embedded systems makes this flaw a significant concern for device stability. Administrators must prioritize applying vendor-supplied updates to the RTOS image to mitigate the risk of remote service disruption caused by malformed protocol packets.

Description Summary:
A vulnerability exists in the Zephyr real-time operating system's BSD-sockets getaddrinfo() implementation, potentially impacting network communication security.

Executive Summary:
A critical vulnerability in the Zephyr RTOS getaddrinfo() implementation may expose network-enabled devices to security risks, requiring prompt remediation.

Vulnerability Details

CVE-ID: CVE-2026-10646

Affected Software: Zephyr Project Zephyr

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the getaddrinfo() function of the BSD-sockets subsystem. This function is responsible for translating hostnames to IP addresses, and flaws here can lead to improper network handling or memory corruption issues.

Business Impact

With a CVSS score of 7.4, this vulnerability poses a high risk to embedded devices running Zephyr, which are often used in critical infrastructure or IoT environments. Exploitation could lead to denial-of-service conditions or potentially remote code execution, undermining the stability and security of the affected hardware.

Remediation Plan

Immediate Action: Update the Zephyr RTOS codebase to the latest version recommended by the Zephyr Project to address the socket implementation flaw.

Proactive Monitoring: Monitor network traffic for unusual socket activity or repeated failures in DNS resolution that could indicate exploitation attempts against the network stack.

Compensating Controls: Implement strict network perimeter defenses to limit the exposure of devices to untrusted networks, reducing the attack surface for socket-related exploits.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the fundamental nature of the networking stack vulnerability necessitates rapid deployment of security updates.

Analyst Recommendation

Security teams managing embedded systems running Zephyr should prioritize the testing and deployment of the provided patch. Due to the critical nature of the network stack, failing to update may leave devices vulnerable to network-based attacks that could compromise the entire system integrity.

Description Summary:
A vulnerability in the Zephyr RTOS IP socket recvmsg() implementation could allow for memory corruption or unauthorized data handling.

Executive Summary:
A high-severity flaw in the Zephyr RTOS network stack's recvmsg() implementation exposes embedded devices to potential memory corruption and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-10643

Affected Software: Zephyr Project Zephyr RTOS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the subsys/net/lib/sockets/sockets_inet component of Zephyr. It involves improper processing of network socket messages, likely allowing an unauthenticated remote attacker to trigger memory corruption via specifically crafted packets.

Business Impact

With a CVSS score of 8.7, this flaw poses a severe threat to embedded systems running Zephyr. Exploitation could lead to remote code execution (RCE) on the target device, potentially granting attackers full control over the hardware, leading to data exfiltration or the device being utilized as a pivot point within the local network.

Remediation Plan

Immediate Action: Upgrade to the latest version of the Zephyr RTOS or apply the specific security patch provided by the project maintainers.

Proactive Monitoring: Implement deep packet inspection (DPI) at the network perimeter to identify and block malformed IP traffic directed at devices running the affected Zephyr stack.

Compensating Controls: Use network segmentation to isolate vulnerable embedded devices from critical network segments, thereby limiting the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical role of the network stack in embedded operations, immediate patching is essential to prevent remote exploitation. Security teams should identify all deployed instances of the Zephyr RTOS and verify their patch status against the latest vendor advisories.