# This week in embedded: 1 November 2026

- Author: Michael Mikus (https://mikus.io/about/)
- Published: 2026-11-01
- Type: Note
- Web page: https://mikus.io/signals/2026-11-01-this-week-in-embedded/

Zephyr 4.5.0 ships with nine more security fixes, plus a critical ESP-TEE flaw, a FreeRTOS MPU fix and an lwIP SNMP leak.

- **Zephyr 4.5.0 is released.** It adds the Infineon TriCore and Qualcomm Hexagon architectures, QUIC and HTTP/3, and SPDX 3.0 SBOMs that record how your firmware was built. SBOMs are part of the evidence the Cyber Resilience Act expects. [Release notes](https://github.com/zephyrproject-rtos/zephyr/releases/tag/v4.5.0)
- **Zephyr published nine more advisories, all fixed in 4.5.0.** The worst is a critical out-of-bounds write in the HTTP/2 server, reachable without authentication when serving static files. Two are high: the Bluetooth Object Transfer Service leaks stack memory to any peer in range, and the GPIO syscalls let user-mode code write kernel memory. [Zephyr advisories](https://github.com/zephyrproject-rtos/zephyr/security/advisories)
- **ESP-IDF disclosed a critical ESP-TEE flaw.** The normal application can write into memory reserved for the trusted execution environment. It is fixed in v5.5.6; the v6.0.4 and v6.1.1 fixes are not tagged yet. Two high-severity flaws, in the Thread Border Router and the lwIP DNS cache, need options that are off by default. [ESP-TEE advisory](https://github.com/espressif/esp-idf/security/advisories/GHSA-49x8-xqjg-2pjg)
- **FreeRTOS 11.3.3 fixes a queue-set flaw on MPU builds.** In V7.4.0 to V11.3.2 with `configUSE_QUEUE_SETS=1`, an unprivileged task could corrupt privileged execution. [Advisory](https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-56j9-g43f-8g6v)
- **lwIP's SNMP agent can leak memory.** CVE-2026-119053 (medium) lets anyone who knows the read community read adjacent buffer memory in lwIP 2.0.0 to 2.2.1. The fix is on main but in no release yet. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-119053)