This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Zephyr Project fixes 9 vulnerabilities

Zephyr Project version 4.4.2 fixes 9 vulnerabilities in the Zephyr operating system [1]. The most severe vulnerabilities are listed below.

Zephyr Project - DoS (CVE-2026-15891)
CVSS 7.5 (High)

An unauthenticated remote attacker can perform a DoS attack due to a NULL pointer dereference when removing an unresponsive MQTT-SN gateway [2].

The vulnerability is present in product:

  • Zephyr Project; >=4.1.0, <4.4.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 14. 9. 2026.

Zephyr Project - DoS, RCE (CVE-2026-14986)
CVSS 6.8 (Medium)

An unauthenticated attacker with physical access to the I2C bus can perform a DoS attack or potentially execute code due to an out-of-bounds write in the ITE it51xxx driver in target mode; the fix covers only the write direction [3].

The vulnerability is present in product:

  • Zephyr Project; >=4.2.0, <4.4.2

CVSS: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 9. 2026.

Zephyr Project - DoS, RCE (CVE-2026-16147)
CVSS 6.8 (Medium)

An unauthenticated attacker with physical access to the device can corrupt kernel memory and perform a DoS attack due to a use-after-free and double free when processing multi-packet USB OUT transfers in the ITE IT82xx2 driver [4].

The vulnerability is present in product:

  • Zephyr Project; >=4.0.0, <4.4.2

CVSS: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 14. 9. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 15. 9. 2026.

CESNET, z.s.p.o. Logo