CVE-2021-3835: Zephyrproject Zephyr

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fm6v-8625-99jf

Affected products

• Zephyrproject Zephyr: from 2.6.0, before 2.7.1 (fixed in 2.7.1); version 3.0.0 only

Published 2022-02-07. Last modified 2026-06-17.