This week in embedded: 1 November 2026

Zephyr 4.5.0 ships with nine more security fixes, plus a critical ESP-TEE flaw, a FreeRTOS MPU fix and an lwIP SNMP leak.

• Zephyr 4.5.0 is released. It adds the Infineon TriCore and Qualcomm Hexagon architectures, QUIC and HTTP/3, and SPDX 3.0 SBOMs that record how your firmware was built. SBOMs are part of the evidence the Cyber Resilience Act expects. Release notes
• Zephyr published nine more advisories, all fixed in 4.5.0. The worst is a critical out-of-bounds write in the HTTP/2 server, reachable without authentication when serving static files. Two are high: the Bluetooth Object Transfer Service leaks stack memory to any peer in range, and the GPIO syscalls let user-mode code write kernel memory. Zephyr advisories
• ESP-IDF disclosed a critical ESP-TEE flaw. The normal application can write into memory reserved for the trusted execution environment. It is fixed in v5.5.6; the v6.0.4 and v6.1.1 fixes are not tagged yet. Two high-severity flaws, in the Thread Border Router and the lwIP DNS cache, need options that are off by default. ESP-TEE advisory
• FreeRTOS 11.3.3 fixes a queue-set flaw on MPU builds. In V7.4.0 to V11.3.2 with configUSE_QUEUE_SETS=1, an unprivileged task could corrupt privileged execution. Advisory
• lwIP’s SNMP agent can leak memory. CVE-2026-119053 (medium) lets anyone who knows the read community read adjacent buffer memory in lwIP 2.0.0 to 2.2.1. The fix is on main but in no release yet. NVD