CVE-2026-1679High· 7.3▾ MidnightPoC availableThe eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow `eswifi->buf`, corrupting kernel memory (CWE-120). Exploit requires local code that can call th…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.2%
The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space; oversized sends overflow eswifi->buf, corrupting kernel memory (CWE-120). Exploit requires local code that can call the socket send API; no remote attacker can reach it directly.
zephyr <= 4.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-9557High· 7.6An out-of-bound write can lead to an arbitrary code execution
CVE-2025-9558High· 7.6There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c
CVE-2026-19570High· 8.8The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without an…
CVE-2026-10672High· 8.2Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)
CVE-2026-10673High· 8.3Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly
CVE-2026-10641High· 7.1Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)