This week in embedded: 25 October 2026

A heavy security week: 17 Zephyr advisories, an lwIP mDNS flaw, four OpenThread advisories and an Mbed TLS audit, plus MCUboot 2.5.0.

• Zephyr published 17 security advisories this week. The most serious include an out-of-bounds write in the Bluetooth HCI USB transport, reachable over the air on some configurations, and a WireGuard flaw that lets an off-path attacker hijack a tunnel. Fixes ship in 4.5.0, now at its third release candidate, and the fixes for these two are also merged on the 4.4 branch. Zephyr advisories
• MCUboot 2.5.0 adds Mbed TLS 4 support and hardens image validation. On Zephyr, USB serial recovery and DFU now use the new USB device stack, so legacy CONFIG_USB_DEVICE_* settings no longer apply. Read the breaking changes before you update your bootloader. Release notes
• lwIP 2.2.1 and earlier can be crashed with bad mDNS responses. CVE-2026-112062 (medium) is a stack overflow during an mDNS service search. The fix is on lwIP’s main branch but in no release yet. NVD
• OpenThread disclosed four medium-severity flaws. They affect NAT64, MLE, mDNS and the commissioner, and each is fixed by a commit on main. OpenThread advisories
• Quarkslab audited Mbed TLS 4.0 for OSTIF. It found one high-severity heap overflow and one low-severity issue; all relevant findings have been fixed. Quarkslab