Open-source firmware report

Flipper Zero

Firmware for the Flipper Zero multi-tool.

github.com/flipperdevices/flipperzero-firmware · 11 components read from oss-flipperdevices__flipperzero-firmware.cdx.json (analysed 2026-10-11) · checked against today's advisories 2026-10-11

Vulnerabilities affecting this build

31reported by a scanner that checks NVD
50reported by Firmpath
19only in vendors' own advisories, or not yet in NVD for this version
3to upgrade
0to look at
0clear
8no advisory source

To upgrade

A published vulnerability affects the version this build uses.

mbedtls 3.6.2 Upgrade to 3.6.7 or later42 vulnerabilities · an NVD scanner reports 26
  • CVE-2024-45158 silabs critical
    Stack buffer overflow in ECDSA signature conversion functions
    raw.githubusercontent.com · cve.org
  • CVE-2025-47917 silabs critical
    Misleading memory management in mbedtls_x509_string_to_names()
    nvd.nist.gov · cve.org
  • CVE-2025-54764 silabs critical
    Side channel in RSA key generation and operations
    nvd.nist.gov · cve.org
  • CVE-2024-30166 silabs critical
    Stack buffer over read in TLS 1.3 server
    raw.githubusercontent.com · cve.org
  • CVE-2025-59438 silabs critical
    Padding oracle through timing of cipher error reporting
    nvd.nist.gov · cve.org
  • CVE-2026-34873 mbedtls high
    Client impersonation while resuming a TLS 1.3 session
    nvd.nist.gov · cve.org
  • CVE-2026-50580 mbedtls missed by NVD scannershigh
    Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-49300 mbedtls missed by NVD scannershigh
    X.509 CA bit forgery via invalid basicConstraints extension
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-50579 mbedtls missed by NVD scannershigh
    Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-25835 mbedtls high
    PSA random generator cloning
    nvd.nist.gov · cve.org
  • CVE-2026-34875 mbedtls high
    Buffer overflow in FFDH public key export
    nvd.nist.gov · cve.org
  • CVE-2024-28960 silabs high
    Vulnerability affecting all VSE devices and TrustZone aware projects using PSA Crypto APIs with array arguments
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-34876 mbedtls high
    CCM multipart finish tag-length validation bypass
    nvd.nist.gov · cve.org
  • CVE-2026-34874 mbedtls high
    Null pointer dereference when setting a distinguished name
    nvd.nist.gov · cve.org
  • CVE-2026-50584 mbedtls missed by NVD scannersmedium
    ChaCha20 counter overflow can reuse keystream
    mbed-tls.readthedocs.io · cve.org
  • CVE-2025-27810 silabs medium
    Uninitialized stack memory used to compose ‘TLS finished’ message which may lead to authentication bypasses
    nvd.nist.gov · cve.org
  • CVE-2026-50587 mbedtls missed by NVD scannersmedium
    Timing side-channel in RSA PKCS#1 v1.5 decryption
    mbed-tls.readthedocs.io · cve.org
  • CVE-2025-49600 silabs medium
    Unchecked return value in LMS verification allows signature bypass
    nvd.nist.gov · cve.org
  • CVE-2025-52496 mbedtls medium
    Race condition in AESNI support detection
    nvd.nist.gov · cve.org
  • CVE-2025-49087 silabs medium
    Timing side-channel in block cipher decryption with PKCS#7 padding
    nvd.nist.gov · cve.org
  • CVE-2026-35336 mbedtls missed by NVD scannersmedium
    Possible buffer overflow in mbedtls_ecdh_calc_secret()
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-34872 mbedtls medium
    FFDH: lack of contributory behaviour due to improper input validation
    nvd.nist.gov · cve.org
  • CVE-2026-73096 mbedtls missed by NVD scannersmedium
    TLS 1.3 early data integrity failure due to buffered plaintext across key change
    mbed-tls.readthedocs.io · cve.org
  • CVE-2020-10932 silabs medium
    Side channel attack on ECDSA
    mbed-tls.readthedocs.io · cve.org
  • CVE-2025-52497 silabs medium
    Heap buffer under-read when parsing PEM-encrypted material
    nvd.nist.gov · cve.org
  • CVE-2026-54435 mbedtls missed by NVD scannersmedium
    Side channel leak in ECC optimized modp
    mbed-tls.readthedocs.io · cve.org
  • CVE-2025-27809 silabs medium
    Server hostname is not verified in a TLS handshake
    nvd.nist.gov · cve.org
  • CVE-2025-49601 silabs medium
    Out-of-bounds read in mbedtls_lms_import_public_key()
    nvd.nist.gov · cve.org
  • CVE-2026-50585 mbedtls missed by NVD scannersmedium
    Incomplete context reset in mbedtls_ssl_session_reset()
    mbed-tls.readthedocs.io · cve.org
  • CVE-2025-48965 silabs medium
    NULL pointer dereference after using mbedtls_asn1_store_named_data()
    nvd.nist.gov · cve.org
  • CVE-2026-54441 mbedtls missed by NVD scannerslow
    Signature algorithm restrictions not enforced on certificate chain
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-73064 mbedtls missed by NVD scannerslow
    A random generator fault can compromise TLS data integrity
    mbed-tls.readthedocs.io · cve.org
  • CVE-2025-66442 mbedtls low
    Compiler-induced constant-time violations
    nvd.nist.gov · cve.org
  • CVE-2026-50640 mbedtls missed by NVD scannerslow
    Ignored TLS 1.3 resumption secret derivation error
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-25833 mbedtls low
    Buffer underflow in x509_inet_pton_ipv6()
    nvd.nist.gov · cve.org
  • CVE-2026-34871 mbedtls low
    Entropy on Linux can fall back to /dev/urandom
    nvd.nist.gov · cve.org
  • CVE-2026-50583 mbedtls missed by NVD scannerslow
    Out-of-bounds read when parsing a zero-length ECC public key
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-25834 mbedtls low
    Signature Algorithm Injection
    nvd.nist.gov · cve.org
  • CVE-2026-34877 mbedtls low
    Risk of insufficient protection of serialized session or context data leading to potential memory safety issues
    nvd.nist.gov · cve.org
  • CVE-2026-50588 mbedtls missed by NVD scannerslow
    Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-50581 mbedtls missed by NVD scannerslow
    Extended master secret calculation failure ignored
    mbed-tls.readthedocs.io · cve.org
  • CVE-2026-50586 mbedtls missed by NVD scannerslow
    Information disclosure in TLS 1.2 NewSessionTicket
    mbed-tls.readthedocs.io · cve.org
freertos-kernel 10.5.1 Upgrade to 10.6.2 or later5 vulnerabilities · an NVD scanner reports 5
  • CVE-2026-77235 freertos high
    Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel
    github.com · cve.org
  • CVE-2026-77236 freertos high
    Missing size validation in SecureContext_AllocateContext in FreeRTOS-Kernel
    github.com · cve.org
  • CVE-2026-77234 freertos high
    Improper input validation in FreeRTOS-Kernel timer command handling
    github.com · cve.org
  • CVE-2024-28115 freertos high
    Potential Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled
    github.com · cve.org
  • CVE-2026-77237 freertos medium
    Missing type validation in xQueueAddToSet in FreeRTOS-Kernel
    github.com · cve.org
nanopb 0.4.8 Upgrade to 0.4.9.2 or later3 vulnerabilities · an NVD scanner reports 0
  • 54a7c338fe2b nanopb missed by NVD scannershigh
    Unbounded recursion when cyclic messages are used
    github.com
  • d80739cff83c nanopb missed by NVD scannershigh
    Callback field inside oneof can cause call into attacker-controlled function pointer
    github.com
  • CVE-2024-53984 nanopb missed by NVD scannersmedium
    Memory is not automatically released on error return when using PB_DECODE_DELIMITED
    github.com · cve.org

No advisory source

No vendor advisory, NVD or OSV record has ever named these. That is not the same as safe: nobody is publishing about them.

How this was made, and what it is not

We read the project's build description (manifests, submodules, the SDK it pins), took each SDK release apart into the libraries it bundles, and compared every version with the ranges in vendors' own advisories, NVD and OSV. Every verdict is computed from versions; each finding links to the document it came from. Missed by NVD scanners means a scanner keyed on NVD's CPE records would not report it for this version: no CVE, no NVD record, or NVD files it under another product. The comparison counts only vulnerabilities affecting the version this build uses.

It describes the repository's default build, not any particular binary, and a project may configure out the affected code. It is not an audit. It is recomputed daily as advisories are published. Also as JSON.