Total
169 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-1675 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 8.2 HIGH |
| The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an untrusted field and does not check if the source buffer is large enough to contain the copied data. | |||||
| CVE-2025-1674 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 8.2 HIGH |
| A lack of input validation allows for out of bounds reads caused by malicious or malformed packets. | |||||
| CVE-2025-1673 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 8.2 HIGH |
| A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation. | |||||
| CVE-2025-10458 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 7.6 HIGH |
| Parameters are not validated or sanitized, and are later used in various internal operations. | |||||
| CVE-2025-10457 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 4.3 MEDIUM |
| The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching. | |||||
| CVE-2025-10456 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 7.1 HIGH |
| A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation. | |||||
| CVE-2024-8798 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 7.5 HIGH |
| No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. | |||||
| CVE-2024-6444 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 6.3 MEDIUM |
| No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c. | |||||
| CVE-2024-6443 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 6.3 MEDIUM |
| In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty. | |||||
| CVE-2024-6442 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 6.3 MEDIUM |
| In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow. | |||||
| CVE-2024-6259 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 7.6 HIGH |
| BT: HCI: adv_ext_report Improper discarding in adv_ext_report | |||||
| CVE-2024-6258 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 6.8 MEDIUM |
| BT: Missing length checks of net_buf in rfcomm_handle_data | |||||
| CVE-2024-6137 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 7.6 HIGH |
| BT: Classic: SDP OOB access in get_att_search_list | |||||
| CVE-2024-6135 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 7.6 HIGH |
| BT:Classic: Multiple missing buf length checks | |||||
| CVE-2024-5931 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 6.3 MEDIUM |
| BT: Unchecked user input in bap_broadcast_assistant | |||||
| CVE-2024-5754 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 8.2 HIGH |
| BT: Encryption procedure host vulnerability | |||||
| CVE-2024-4785 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 7.6 HIGH |
| BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero | |||||
| CVE-2024-3332 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 6.5 MEDIUM |
| A malicious BLE device can send a specific order of packet sequence to cause a DoS attack on the victim BLE device | |||||
| CVE-2024-3077 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 6.8 MEDIUM |
| An malicious BLE device can crash BLE victim device by sending malformed gatt packet | |||||
| CVE-2024-1638 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 8.2 HIGH |
| The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read. | |||||