Zephyr RTOS CVE-2026-10593

The victim device must be running Zephyr v4.3.0, v4.4.0, or an earlier version with the BAP unicast client subsystem enabled (CONFIG_BT_BAP_UNICAST_CLIENT). Exploitation requires the attacker to be within Bluetooth LE radio range and to have established a BT LE connection to the victim device acting as a remote ASCS server. The vulnerable window exists specifically between the time bt_bap_stream_config() completes (setting stream->qos to NULL) and unicast_group_add_stream() is called (which would populate stream->qos). The attacker must send a GATT ASE state notification announcing QoS Configured during this window; the BAP state machine's explicit permission of the Codec Configured → QoS Configured transition means no protocol violation is required. From CVSS PR:N, no authentication on the victim device is required. Limiting factors: physical Bluetooth LE adjacency is mandatory (not internet-reachable), the device must have initiated a codec configuration flow, and the BAP unicast client must be compiled into the firmware.

CVSS 6.5 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H places real-world priority in the moderate range. The adjacent-only attack vector (Bluetooth LE radio range, typically under 100 meters) is the primary limiter - this is not a remote internet-reachable flaw. Exploitation requires the attacker to be physically proximate and to complete a BT LE connection as a server to the victim device, which narrows the threat actor pool significantly. The impact is pure denial of service (device crash); there is no confidentiality or integrity component despite the description noting that the written data is attacker-controlled, because the NULL dereference causes a crash before any persistent state change can occur. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV. No public proof-of-concept has been identified. SSVC assessment: exploitation status = none publicly known; automatable = yes within BT LE range once a connection is established; technical impact = partial (DoS only, no data exposure). For IoT and embedded deployments using Zephyr in BT LE Audio contexts - medical devices, hearing aids, industrial sensors - even a DoS is operationally significant, elevating practical priority above what raw CVSS might suggest.

An attacker within Bluetooth LE radio range of a Zephyr-based device (such as a hearing aid, audio accessory, or industrial sensor) establishes a connection posing as an ASCS server. After the victim device performs codec configuration on a BAP stream (bt_bap_stream_config()), but before it adds the stream to a unicast group (unicast_group_add_stream()), the attacker sends a crafted GATT notification announcing the ASE has entered the QoS Configured state; this triggers unicast_client_ep_qos_state() to write attacker-controlled QoS values through the NULL stream->qos pointer, causing an immediate crash and denial of service. No public exploit code has been identified at time of analysis.