CVE-2025-9557

HighCVSS 7.6/10Last modified Oct 13, 2026

Description

‭An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to‬ ‭a crash and a resultant denial of service.‬

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
zephyrproject-rtos	Zephyr	< 4.2.2

References

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r3j3-c5v7-2ppf

Timeline

Published: Nov 26, 2025
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-95587.6There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into CVE-2025-95596.5Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that CVE-2025-95606.4The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in CVE-2025-95618.8The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and insufficient file validation CVE-2025-95626.4The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in a CVE-2025-95656.4The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksy_newsletter_subscribe shortc CVE-2025-95668.1There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Sec CVE-2025-95676.1The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitr CVE-2025-95686.1The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitr CVE-2025-95696.1The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitr CVE-2025-95704.9The eHRD CTMS developed by Sunnet has an Arbitrary File Reading vulnerability, allowing remote attackers with administrator privileges to ex CVE-2025-95718.7A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion