Which CVEs affect Zephyr 4.4.0?
No note: the vendor names the CVE in its own advisory for this version (222 of 224).
| CVE | Severity | CVSS | Fixed from | Note |
|---|---|---|---|---|
| CVE-2026-10666 | critical | 9.8 | 4.4.1 | |
| CVE-2026-13214 | critical | 9.8 | 4.4.2 | |
| CVE-2026-10672 | critical | 9.1 | 4.6.0 | |
| CVE-2026-82391 | critical | 9.1 | 4.5.0 | |
| CVE-2026-10673 | high | 8.8 | 4.4.1 | |
| CVE-2026-12366 | high | 8.8 | 4.5.0 | |
| CVE-2026-12522 | high | 8.8 | 4.4.2 | |
| CVE-2026-13212 | high | 8.8 | 4.4.2 | |
| CVE-2026-15894 | high | 8.8 | 4.4.2 | |
| CVE-2026-16511 | high | 8.8 | 4.5.0 | |
| CVE-2026-19569 | high | 8.8 | 4.5.0 | |
| CVE-2026-19570 | high | 8.8 | 4.5.0 | |
| CVE-2026-5068 | high | 8.8 | not stated | vendor and another source disagree |
| CVE-2026-76788 | high | 8.8 | 4.5.0 | |
| CVE-2026-79982 | high | 8.8 | 4.5.0 | |
| CVE-2026-85035 | high | 8.8 | 4.5.0 | |
| CVE-2026-9771 | high | 8.8 | 4.4.2 | |
| CVE-2026-10848 | high | 8.6 | 4.4.2 | |
| CVE-2026-12364 | high | 8.4 | 4.4.2 | |
| CVE-2026-19184 | high | 8.4 | 4.5.0 | |
| CVE-2026-8718 | high | 8.4 | 4.4.1 | |
| CVE-2026-77685 | high | 8.3 | 4.5.0 | |
| CVE-2026-87040 | high | 8.3 | 4.5.0 | |
| CVE-2026-79977 | high | 8.2 | 4.5.0 | |
| CVE-2026-10653 | high | 8.1 | 4.4.2 | |
| CVE-2026-10678 | high | 8.1 | 4.4.2 | |
| CVE-2026-12633 | high | 8.1 | 4.4.2 | |
| CVE-2026-19186 | high | 8.1 | 4.5.0 | |
| CVE-2026-9263 | high | 8.1 | 4.4.1 | |
| CVE-2026-10643 | high | 7.8 | 4.4.2 | |
| CVE-2026-10667 | high | 7.8 | 4.6.0 | |
| CVE-2026-10669 | high | 7.8 | 4.4.1 | |
| CVE-2026-10682 | high | 7.8 | 4.4.2 | |
| CVE-2026-12234 | high | 7.8 | 4.4.2 | |
| CVE-2026-16513 | high | 7.8 | 4.4.2 | |
| CVE-2026-17052 | high | 7.8 | 4.4.2 | |
| CVE-2026-18413 | high | 7.8 | 4.4.2 | |
| CVE-2026-18414 | high | 7.8 | 4.4.2 | |
| CVE-2026-19185 | high | 7.8 | 4.5.0 | |
| CVE-2026-19575 | high | 7.8 | 4.5.0 | |
| CVE-2026-19669 | high | 7.8 | 4.5.0 | |
| CVE-2026-19676 | high | 7.8 | 4.5.0 | |
| CVE-2026-19736 | high | 7.8 | 4.5.0 | |
| CVE-2026-79979 | high | 7.8 | 4.5.0 | |
| CVE-2026-82961 | high | 7.8 | 4.5.0 | |
| CVE-2026-87039 | high | 7.8 | 4.5.0 | |
| CVE-2026-87041 | high | 7.8 | 4.5.0 | |
| CVE-2026-90586 | high | 7.8 | 4.5.0 | |
| CVE-2026-90833 | high | 7.8 | 4.5.0 | |
| CVE-2026-91007 | high | 7.8 | 4.5.0 | |
| CVE-2026-10680 | high | 7.6 | 4.4.2 | |
| CVE-2026-10685 | high | 7.6 | 4.4.2 | |
| CVE-2026-10638 | high | 7.5 | 4.4.1 | |
| CVE-2026-10686 | high | 7.5 | 4.5.0 | |
| CVE-2026-10849 | high | 7.5 | 4.4.2 | |
| CVE-2026-11810 | high | 7.5 | 4.4.2 | |
| CVE-2026-13351 | high | 7.5 | not stated | vendor and another source disagree |
| CVE-2026-15891 | high | 7.5 | 4.4.2 | |
| CVE-2026-19741 | high | 7.5 | 4.5.0 | |
| CVE-2026-19935 | high | 7.5 | 4.5.0 | |
| CVE-2026-8023 | high | 7.5 | 4.6.0 | |
| CVE-2026-87045 | high | 7.5 | 4.5.0 | |
| CVE-2026-90591 | high | 7.5 | 4.5.0 | |
| CVE-2026-10646 | high | 7.4 | 4.4.2 | |
| CVE-2026-10652 | high | 7.4 | 4.4.1 | |
| CVE-2026-10665 | high | 7.4 | 4.4.2 | |
| CVE-2026-10637 | high | 7.1 | 4.4.1 | |
| CVE-2026-10640 | high | 7.1 | 4.4.1 | |
| CVE-2026-10641 | high | 7.1 | 4.4.2 | |
| CVE-2026-10658 | high | 7.1 | 4.6.0 | |
| CVE-2026-10671 | high | 7.1 | 4.4.2 | |
| CVE-2026-18415 | high | 7.1 | 4.4.2 | |
| CVE-2026-19577 | high | 7.1 | 4.5.0 | |
| CVE-2026-19673 | high | 7.1 | 4.5.0 | |
| CVE-2026-79976 | high | 7.1 | 4.5.0 | |
| CVE-2026-81038 | high | 7.1 | 4.5.0 | |
| CVE-2026-10681 | high | 7.0 | 4.4.2 | |
| CVE-2026-19574 | high | 7.0 | 4.5.0 | |
| CVE-2026-78118 | high | 7.0 | 4.5.0 | |
| CVE-2026-87038 | high | 7.0 | 4.5.0 | |
| CVE-2026-126957 | medium | 6.9 | not stated | |
| CVE-2026-13215 | medium | 6.8 | 4.4.2 | |
| CVE-2026-14986 | medium | 6.8 | 4.4.2 | |
| CVE-2026-16147 | medium | 6.8 | 4.4.2 | |
| CVE-2026-19576 | medium | 6.8 | 4.5.0 | |
| CVE-2026-75084 | medium | 6.8 | 4.5.0 | |
| CVE-2026-7656 | medium | 6.8 | 4.6.0 | |
| CVE-2026-19571 | medium | 6.7 | 4.5.0 | |
| CVE-2026-85034 | medium | 6.7 | 4.5.0 | |
| CVE-2026-11743 | medium | 6.6 | 4.4.2 | |
| CVE-2026-10593 | medium | 6.5 | 4.5.0 | |
| CVE-2026-10642 | medium | 6.5 | 4.4.2 | |
| CVE-2026-10651 | medium | 6.5 | 4.6.0 | |
| CVE-2026-10675 | medium | 6.5 | 4.4.2 | |
| CVE-2026-10677 | medium | 6.5 | 4.4.2 | |
| CVE-2026-10774 | medium | 6.5 | 4.4.2 | |
| CVE-2026-11368 | medium | 6.5 | 4.4.2 | |
| CVE-2026-12236 | medium | 6.5 | 4.4.2 | |
| CVE-2026-12631 | medium | 6.5 | 4.4.2 | |
| CVE-2026-12632 | medium | 6.5 | 4.4.2 | |
| CVE-2026-13734 | medium | 6.5 | 4.4.2 | |
| CVE-2026-14696 | medium | 6.5 | 4.4.2 | |
| CVE-2026-14697 | medium | 6.5 | 4.4.2 | |
| CVE-2026-15893 | medium | 6.5 | 4.4.2 | |
| CVE-2026-18417 | medium | 6.5 | 4.4.2 | |
| CVE-2026-19738 | medium | 6.5 | 4.5.0 | |
| CVE-2026-19739 | medium | 6.5 | 4.5.0 | |
| CVE-2026-19740 | medium | 6.5 | 4.5.0 | |
| CVE-2026-19940 | medium | 6.5 | 4.5.0 | |
| CVE-2026-2411 | medium | 6.5 | 4.4.2 | |
| CVE-2026-79981 | medium | 6.5 | 4.5.0 | |
| CVE-2026-82389 | medium | 6.5 | 4.5.0 | |
| CVE-2026-82962 | medium | 6.5 | 4.5.0 | |
| CVE-2026-87042 | medium | 6.5 | 4.5.0 | |
| CVE-2026-87044 | medium | 6.5 | 4.5.0 | |
| CVE-2026-90590 | medium | 6.5 | 4.5.0 | |
| CVE-2026-10660 | medium | 6.4 | 4.4.2 | |
| CVE-2026-12520 | medium | 6.4 | 4.4.2 | |
| CVE-2026-14366 | medium | 6.4 | 4.4.2 | |
| CVE-2026-9728 | medium | 6.4 | 4.4.2 | |
| CVE-2026-10635 | medium | 6.3 | 4.4.2 | |
| CVE-2026-12235 | medium | 6.3 | 4.4.2 | |
| CVE-2026-19939 | medium | 6.3 | 4.5.0 | |
| CVE-2026-78119 | medium | 6.3 | 4.5.0 | |
| CVE-2026-10663 | medium | 6.1 | 4.4.2 | |
| CVE-2026-12232 | medium | 6.1 | 4.5.0 | |
| CVE-2026-13216 | medium | 6.1 | 4.4.2 | |
| CVE-2026-18747 | medium | 6.1 | 4.4.2 | |
| CVE-2026-19595 | medium | 6.1 | 4.5.0 | |
| CVE-2026-17051 | medium | 6.0 | 4.4.2 | |
| CVE-2026-10655 | medium | 5.9 | 4.4.2 | |
| CVE-2026-11893 | medium | 5.9 | 4.4.2 | |
| CVE-2026-11894 | medium | 5.9 | 4.4.2 | |
| CVE-2026-12233 | medium | 5.9 | 4.4.2 | |
| CVE-2026-13217 | medium | 5.9 | 4.4.2 | |
| CVE-2026-15924 | medium | 5.9 | 4.4.2 | |
| CVE-2026-18746 | medium | 5.9 | 4.5.0 | |
| CVE-2026-19938 | medium | 5.9 | 4.5.0 | |
| CVE-2026-75083 | medium | 5.9 | 4.5.0 | |
| CVE-2026-76787 | medium | 5.9 | 4.5.0 | |
| CVE-2026-12365 | medium | 5.8 | 4.5.0 | |
| CVE-2026-17050 | medium | 5.7 | 4.4.2 | |
| CVE-2026-19937 | medium | 5.7 | 4.5.0 | |
| CVE-2026-77684 | medium | 5.7 | 4.5.0 | |
| CVE-2026-85036 | medium | 5.7 | 4.5.0 | |
| CVE-2026-79980 | medium | 5.6 | 4.5.0 | |
| CVE-2026-10645 | medium | 5.5 | 4.6.0 | |
| CVE-2026-10648 | medium | 5.5 | 4.4.1 | |
| CVE-2026-10670 | medium | 5.5 | 4.4.2 | |
| CVE-2026-10674 | medium | 5.5 | 4.4.2 | |
| CVE-2026-10679 | medium | 5.5 | 4.4.2 | |
| CVE-2026-13478 | medium | 5.5 | 4.4.2 | |
| CVE-2026-19737 | medium | 5.5 | 4.5.0 | |
| CVE-2026-90589 | medium | 5.5 | 4.5.0 | |
| CVE-2026-90834 | medium | 5.5 | 4.5.0 | |
| CVE-2026-10773 | medium | 5.4 | 4.4.2 | |
| CVE-2026-13481 | medium | 5.4 | 4.4.2 | |
| CVE-2026-14368 | medium | 5.4 | 4.4.2 | |
| CVE-2026-15460 | medium | 5.4 | 4.4.2 | |
| CVE-2026-10634 | medium | 5.3 | 4.4.1 | |
| CVE-2026-10647 | medium | 5.3 | 4.4.2 | |
| CVE-2026-10657 | medium | 5.3 | 4.4.2 | |
| CVE-2026-12634 | medium | 5.3 | 4.5.0 | |
| CVE-2026-12999 | medium | 5.3 | 4.4.2 | |
| CVE-2026-13213 | medium | 5.3 | 4.4.2 | |
| CVE-2026-13343 | medium | 5.3 | 4.4.2 | |
| CVE-2026-15461 | medium | 5.3 | 4.4.2 | |
| CVE-2026-15890 | medium | 5.3 | 4.4.2 | |
| CVE-2026-15892 | medium | 5.3 | 4.4.2 | |
| CVE-2026-17054 | medium | 5.3 | 4.4.2 | |
| CVE-2026-18416 | medium | 5.3 | 4.4.2 | |
| CVE-2026-19947 | medium | 5.3 | 4.5.0 | |
| CVE-2026-82388 | medium | 5.3 | 4.5.0 | |
| CVE-2026-12052 | medium | 5.2 | 4.4.2 | |
| CVE-2026-78116 | medium | 5.2 | 4.5.0 | |
| CVE-2026-10664 | medium | 5.0 | 4.5.0 | |
| CVE-2026-12519 | medium | 5.0 | 4.4.2 | |
| CVE-2026-10639 | medium | 4.8 | 4.4.1 | |
| CVE-2026-19735 | medium | 4.8 | 4.5.0 | |
| CVE-2026-19936 | medium | 4.8 | 4.5.0 | |
| CVE-2026-85032 | medium | 4.8 | 4.5.0 | |
| CVE-2026-87043 | medium | 4.8 | 4.5.0 | |
| CVE-2026-10659 | medium | 4.7 | 4.4.2 | |
| CVE-2026-16515 | medium | 4.7 | 4.4.2 | |
| CVE-2026-10656 | medium | 4.6 | 4.4.1 | |
| CVE-2026-10668 | medium | 4.6 | 4.4.2 | |
| CVE-2026-10683 | medium | 4.6 | 4.4.2 | |
| CVE-2026-12051 | medium | 4.6 | 4.4.2 | |
| CVE-2026-12629 | medium | 4.6 | 4.4.2 | |
| CVE-2026-15923 | medium | 4.6 | 4.4.2 | |
| CVE-2026-16148 | medium | 4.6 | 4.4.2 | |
| CVE-2026-7007 | medium | 4.6 | 4.4.2 | |
| CVE-2026-85033 | medium | 4.6 | 4.5.0 | |
| CVE-2026-90585 | medium | 4.6 | 4.5.0 | |
| CVE-2026-90587 | medium | 4.6 | 4.5.0 | |
| CVE-2026-17053 | medium | 4.4 | 4.4.2 | |
| CVE-2026-12630 | medium | 4.3 | 4.4.2 | |
| CVE-2026-13479 | medium | 4.3 | 4.4.2 | |
| CVE-2026-16514 | medium | 4.3 | 4.4.2 | |
| CVE-2026-81039 | medium | 4.3 | 4.5.0 | |
| CVE-2026-90832 | medium | 4.3 | 4.5.0 | |
| CVE-2026-12363 | medium | 4.2 | 4.5.0 | |
| CVE-2026-75085 | medium | 4.2 | 4.5.0 | |
| CVE-2026-78117 | medium | 4.2 | 4.5.0 | |
| CVE-2026-10636 | low | 3.7 | 4.4.1 | |
| CVE-2026-11809 | low | 3.7 | 4.4.2 | |
| CVE-2026-11811 | low | 3.7 | 4.4.2 | |
| CVE-2026-13735 | low | 3.7 | 4.4.2 | |
| CVE-2026-19742 | low | 3.7 | 4.5.0 | |
| CVE-2026-82390 | low | 3.7 | 4.5.0 | |
| CVE-2026-90588 | low | 3.7 | 4.5.0 | |
| CVE-2026-11742 | low | 3.6 | 4.4.2 | |
| CVE-2026-11985 | low | 3.6 | 4.4.2 | |
| CVE-2026-79978 | low | 3.6 | 4.5.0 | |
| CVE-2026-18748 | low | 3.5 | 4.5.0 | |
| CVE-2026-18418 | low | 3.4 | 4.4.2 | |
| CVE-2026-19809 | low | 3.3 | 4.5.0 | |
| CVE-2026-10644 | low | 3.1 | 4.4.2 | |
| CVE-2026-10654 | low | 3.1 | 4.4.2 | |
| CVE-2026-13480 | low | 3.1 | 4.4.2 | |
| CVE-2026-14367 | low | 3.1 | 4.4.2 | |
| CVE-2026-16512 | low | 3.1 | 4.4.2 | |
| CVE-2026-10684 | low | 3.0 | 4.4.2 | |
| CVE-2026-11812 | low | 2.5 | 4.4.2 |
Which Zephyr version do I need to upgrade to?
Fixed in Zephyr 4.4.1: 14 CVEs of this version.
Fixed in Zephyr 4.4.2: 109 CVEs of this version.
Fixed in Zephyr 4.5.0: 91 CVEs of this version.
Fixed in Zephyr 4.6.0: 7 CVEs of this version.
No fix version stated: 3.
What changed against Zephyr 4.3.2?
4 CVEs of 4.3.2 are no longer listed for 4.4.0: CVE-2026-0849, CVE-2026-1677, CVE-2026-1679, CVE-2026-1681.
149 CVEs are newly listed for 4.4.0: CVE-2026-10634, CVE-2026-10635, CVE-2026-10644, CVE-2026-10646, CVE-2026-10648, CVE-2026-10652, CVE-2026-10653, CVE-2026-10654, CVE-2026-10655, CVE-2026-10657, CVE-2026-10659, CVE-2026-10660 (+137).
What does the number mean for a device?
Counted are the CVEs public sources name for Zephyr version 4.4.0 (NVD, OSV, Vendor advisories). "Confirmed by the vendor" means the CVE record or advisory comes from the vendor itself and names this version as affected. Third-party records are counted but not marked as confirmed.
Whether a CVE is exploitable in a given device depends on which functions of the library the build contains and how they are configured. The list shows what is known for the version.
Licence notes of the sources: OSV: CC BY 4.0.
Questions
How many CVEs does Zephyr 4.4.0 have?
As of 13 Nov 2026, 224 CVEs are known for Zephyr 4.4.0, 4 critical and 76 high. The vendor names 222 in its own advisory for exactly this version. For 2, the vendor's statement and another source disagree; they are counted and marked. 4.5.0, the newest listed version, still carries 10 of them.
From which version are the CVEs of Zephyr 4.4.0 fixed?
No newer listed version is free of all 224 CVEs. The "Fixed from" column names the fix version per CVE for this release line where a source states one.