Zephyr Bluetooth Host
CVE-2025-12035
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition within Bluetooth BR/EDR range
-
DeliveryEstablish L2CAP connection to target
-
ExploitSend crafted oversized ACL/L2CAP packet
-
ExecutionTrigger integer overflow in bt_br_acl_recv
-
ImpactCrash Bluetooth host stack (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target Zephyr device to have the Bluetooth BR/EDR (Bluetooth Classic) host stack enabled and actively processing inbound L2CAP/ACL traffic - devices built BLE-only or with Bluetooth disabled are not exposed. Exploitation is constrained to the adjacent attack surface (AV:A): the attacker must be within Bluetooth radio range and able to send ACL data reaching bt_br_acl_recv. Per CVSS PR:N/UI:N no authentication or user interaction is needed, but reaching the vulnerable BR/EDR L2CAP path in practice may require an established/accepted connection depending on device configuration; impact is limited to availability (crash/DoS), not code execution or data disclosure. |
| Impact | This is a moderate, availability-only issue rather than a top-tier priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes an unauthenticated, no-interaction, low-complexity attack but limited to the adjacent (Bluetooth radio) layer and impacting only availability - consistent with an integer overflow (CWE-190) in bt_br_acl_recv causing a crash/denial of service rather than code execution or data compromise. All exploitation signals point AWAY from urgency: EPSS is only 0.20% (9th percentile), the CVE is NOT on CISA KEV, and no public exploit code is identified. Exploitation status: no public exploit identified at time of analysis. The main caveat is a signal tension worth verifying: the CWE and the 'Buffer Overflow' tag hint that the integer overflow could feed a memory-corruption primitive, yet the vendor-assigned CVSS sets C:N/I:N and only A:H, indicating they assessed impact as DoS - if a downstream buffer overflow were confirmed to be controllable, integrity/confidentiality impact could rise, so defenders handling attacker-reachable BR/EDR devices should confirm the exact corruption behavior with the Zephyr advisory. |
| Exploit ScenarioDerived | An attacker within Bluetooth radio range of a Zephyr-based device that has BR/EDR (Bluetooth Classic) enabled sends crafted inbound L2CAP traffic whose length/size field triggers the integer overflow in bt_br_acl_recv. The malformed ACL data corrupts internal length handling and crashes or hangs the Bluetooth host stack, denying service to the affected device. No public exploit code is identified at time of analysis, and no authentication or user interaction is required per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Integer overflow in the Zephyr Bluetooth Host stack's bt_br_acl_recv routine lets an attacker within Bluetooth radio range crash or hang devices that process inbound BR/EDR L2CAP ACL traffic, producing an availability-only denial of service. Only builds compiled with the Bluetooth Classic (BR/EDR) host stack enabled and actively handling L2CAP/ACL data are exposed; BLE-only or Bluetooth-disabled configurations are unaffected. No public exploit has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is 0.20% (9th percentile), making this a moderate, availability-only issue with no confidentiality or integrity impact.
RemediationAI
No vendor-released patch or fixed version was identified in the available data at time of analysis; the primary action is to track advisory GHSA-p793-3456-h7w3 (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p793-3456-h7w3) and apply the Zephyr upstream fix and corresponding release as soon as it is published, then rebuild and reflash affected firmware. Where immediate mitigation is required, the most effective control is to disable the Bluetooth Classic (BR/EDR) host stack at build time - e.g. removing the BR/EDR configuration option so only BLE runs - with the trade-off that all classic profiles (A2DP, HID over BR/EDR, SPP, etc.) stop working; disabling the Bluetooth subsystem entirely is stronger but removes wireless functionality altogether. Restricting exposure by keeping devices non-discoverable/non-connectable, limiting accepted connections, and reducing the physical/radio range in which untrusted Bluetooth peers can reach the device lowers the likelihood of exploitation but does not remove the vulnerable code path, and monitoring Zephyr security advisories plus vendor firmware channels is necessary until a patched build can be deployed. Specialized detections such as ACL length or L2CAP sanity bounds checks can be added as an interim guard, though they carry the risk of dropping legitimate traffic and are not a substitute for the upstream fix.
Affected ProductsAI
The affected component is the Zephyr RTOS Bluetooth Host implementation, in the BR/EDR (Bluetooth Classic) ACL receive path handling inbound L2CAP traffic; devices running Zephyr builds with the Bluetooth Classic host stack enabled and actively processing BR/EDR ACL data are in scope, while BLE-only or Bluetooth-disabled builds are not exposed. Vendor advisory GHSA-p793-3456-h7w3 (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p793-3456-h7w3) is the authoritative source. No CPE identifiers or explicit version ranges were supplied in the available data, so the precise affected release set should be confirmed against that advisory and the Zephyr release notes for the corresponding fixed revision.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an integer overflow (CWE-190) in the Bluedroid-derived Zephyr Bluetooth Host stack, specifically in bt_br_acl_recv, the routine that ingests inbound BR/EDR (Bluetooth Classic) ACL data and hands it up to the L2CAP layer. Because the arithmetic that handles lengths or counters in this inbound path can wrap, malformed ACL/L2CAP traffic can produce out-of-bounds memory operations (the advisory carries both Integer Overflow and Buffer Overflow tags), corrupting host state and causing a crash or hang. The assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the exposure is adjacent - the attacker must be within Bluetooth radio range and able to deliver ACL data reaching bt_br_acl_recv - with no authentication or user interaction required per the vector, and impact confined to availability (S:U, C:N, I:N, A:H). Reaching this BR/EDR L2CAP path in practice may require an established or accepted connection depending on device configuration, and the flaw does not yield code execution or data disclosure.
Know when Bluetooth gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent Bluetooth radio reach (AV:A), no auth or interaction to feed crafted L2CAP data (PR:N/UI:N), and an integer overflow that crashes the stack yields availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (zephyrproject).
CVSS VectorVendor: zephyrproject
DescriptionCVE.org
An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware
CVE-2025-32879 is a security vulnerability (CVSS 8.8) that allows an attacker. Risk factors: public PoC available.
Zephyr's Bluetooth Low Energy connection-response handler fails to verify that a connection request was actually initiat
Heap OOB write in Android Bluetooth driver via incorrect bounds check.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an att
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attac
A memory leak combined with a use-after-free in the Linux kernel's Bluetooth HCI connection-setup path can crash the ker
A race condition in the Linux kernel's Bluetooth L2CAP subsystem allows a use-after-free of the hci_conn::l2cap_data poi
Bluetooth authentication bypass in SwitchBot Door Lock Series allows an attacker within BLE range to manipulate the lock
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into usersp
Use-after-free in the Linux kernel Bluetooth L2CAP stack lets a Bluetooth-adjacent attacker corrupt kernel memory by rac
Exploit-DB