# This week in embedded: 25 October 2026

- Author: Michael Mikus (https://mikus.io/about/)
- Published: 2026-10-25
- Type: Note
- Web page: https://mikus.io/signals/2026-10-25-this-week-in-embedded/

A heavy security week: 17 Zephyr advisories, an lwIP mDNS flaw, four OpenThread advisories and an Mbed TLS audit, plus MCUboot 2.5.0.

- **Zephyr published 17 security advisories this week.** The most serious include an out-of-bounds write in the Bluetooth HCI USB transport, reachable over the air on some configurations, and a WireGuard flaw that lets an off-path attacker hijack a tunnel. Fixes ship in 4.5.0, now at its third release candidate, and the fixes for these two are also merged on the 4.4 branch. [Zephyr advisories](https://github.com/zephyrproject-rtos/zephyr/security/advisories)
- **MCUboot 2.5.0 adds Mbed TLS 4 support and hardens image validation.** On Zephyr, USB serial recovery and DFU now use the new USB device stack, so legacy `CONFIG_USB_DEVICE_*` settings no longer apply. Read the breaking changes before you update your bootloader. [Release notes](https://github.com/mcu-tools/mcuboot/blob/v2.5.0/docs/release-notes.md)
- **lwIP 2.2.1 and earlier can be crashed with bad mDNS responses.** CVE-2026-112062 (medium) is a stack overflow during an mDNS service search. The fix is on lwIP's main branch but in no release yet. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-112062)
- **OpenThread disclosed four medium-severity flaws.** They affect NAT64, MLE, mDNS and the commissioner, and each is fixed by a commit on main. [OpenThread advisories](https://github.com/openthread/openthread/security/advisories)
- **Quarkslab audited Mbed TLS 4.0 for OSTIF.** It found one high-severity heap overflow and one low-severity issue; all relevant findings have been fixed. [Quarkslab](https://blog.quarkslab.com/mbedtls-security-audit.html)