Open-source firmware report

PebbleOS

The Pebble smartwatch operating system.

github.com/coredevices/PebbleOS · 13 components read from oss-coredevices__PebbleOS.cdx.json (analysed 2026-10-11) · checked against today's advisories 2026-10-11

Vulnerabilities affecting this build

0reported by a scanner that checks NVD
2reported by Firmpath
2only in vendors' own advisories, or not yet in NVD for this version
1to upgrade
2to look at
0clear
10no advisory source

To upgrade

A published vulnerability affects the version this build uses.

nanopb 0.4.9.1 Upgrade to 0.4.9.2 or later2 vulnerabilities · an NVD scanner reports 0
  • 54a7c338fe2b nanopb missed by NVD scannershigh
    Unbounded recursion when cyclic messages are used
    github.com
  • d80739cff83c nanopb missed by NVD scannershigh
    Callback field inside oneof can cause call into attacker-controlled function pointer
    github.com

To look at

Version numbers cannot settle these: usually a vendor's fork that may already carry the fix.

nimble 2ea18b9af381cb6741620fb710395b5d506d323d A vendor fork: check whether it carries the fixes10 vulnerabilities · an NVD scanner reports 10
  • CVE-2026-45813 nimble high
    Incorrect data validation in BASS add/modify source operation
    nvd.nist.gov · cve.org
  • CVE-2026-45815 nimble high
    Remote reachable assertion in ATT Read Multiple Variable Response handler
    nvd.nist.gov · cve.org
  • CVE-2026-45811 nimble high
    Buffer overflow in socket HCI transport
    nvd.nist.gov · cve.org
  • CVE-2025-52435 nimble high
    Invalid error handling in pause encryption procedure in NimBLE controller
    nvd.nist.gov · cve.org
  • CVE-2025-62235 nimble high
    Incorrect handling of SMP Security Request could lead to undesirable pairing
    nvd.nist.gov · cve.org
  • CVE-2025-53477 nimble high
    NULL Pointer Dereference in NimBLE host HCI layer
    nvd.nist.gov · cve.org
  • CVE-2026-45816 nimble high
    NULL pointer dereference vulnerability in SMP LTK request
    nvd.nist.gov · cve.org
  • CVE-2026-45812 nimble medium
    OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
    nvd.nist.gov · cve.org
  • CVE-2026-46452 nimble medium
    Mesh Proxy SAR reassembly unbounded append and unchecked failure
    nvd.nist.gov · cve.org
  • CVE-2025-53470 nimble low
    Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
    nvd.nist.gov · cve.org
freertos-kernel 8583941bff119369cad8dc65489a7d05140f5f67 Version numbers can't settle this. Have a look.5 vulnerabilities · an NVD scanner reports 5
  • CVE-2026-77235 freertos high
    Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel
    github.com · cve.org
  • CVE-2026-77236 freertos high
    Missing size validation in SecureContext_AllocateContext in FreeRTOS-Kernel
    github.com · cve.org
  • CVE-2026-77234 freertos high
    Improper input validation in FreeRTOS-Kernel timer command handling
    github.com · cve.org
  • CVE-2024-28115 freertos high
    Potential Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled
    github.com · cve.org
  • CVE-2026-77237 freertos medium
    Missing type validation in xQueueAddToSet in FreeRTOS-Kernel
    github.com · cve.org

No advisory source

No vendor advisory, NVD or OSV record has ever named these. That is not the same as safe: nobody is publishing about them.

How this was made, and what it is not

We read the project's build description (manifests, submodules, the SDK it pins), took each SDK release apart into the libraries it bundles, and compared every version with the ranges in vendors' own advisories, NVD and OSV. Every verdict is computed from versions; each finding links to the document it came from. Missed by NVD scanners means a scanner keyed on NVD's CPE records would not report it for this version: no CVE, no NVD record, or NVD files it under another product. The comparison counts only vulnerabilities affecting the version this build uses.

It describes the repository's default build, not any particular binary, and a project may configure out the affected code. It is not an audit. It is recomputed daily as advisories are published. Also as JSON.