EUVD-2026-39981Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent Bluetooth LE vector limits range; PR:N because no victim-side authentication is needed; pure availability impact with no confidentiality or integrity consequence.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
Lifecycle Timeline
2DescriptionCVE.org
The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream-qos pointer with only a stream != NULL guard. stream-qos is NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (it is set only by unicast_group_add_stream()). A malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state - a transition the dispatcher explicitly permits - during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled. The defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep-qos struct, eliminating the NULL dereference.
AnalysisAI
NULL pointer dereference in the Zephyr Bluetooth LE Audio Basic Audio Profile unicast client crashes devices running Zephyr v4.3.0 and v4.4.0 (and earlier) when connected to a malicious or buggy remote ASCS server. The handler unicast_client_ep_qos_state() writes attacker-controlled QoS fields through stream->qos without verifying the pointer is non-NULL - a condition that legitimately exists during the window between bt_bap_stream_config() and unicast_group_add_stream(). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but CVSS adjacency (AV:A) and no-auth (PR:N) make it exploitable by any device within Bluetooth LE radio range acting as a rogue ASCS server.
Technical ContextAI
Zephyr RTOS (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) implements the Bluetooth LE Audio Basic Audio Profile unicast client in subsys/bluetooth/audio/bap_unicast_client.c. The root cause is CWE-476 (NULL Pointer Dereference): the stream->qos pointer is populated only when a stream is added to a unicast group via unicast_group_add_stream(), but the GATT notification dispatcher in unicast_client_ep_qos_state() guards only against stream NULL, not stream->qos NULL. Because the BAP state machine explicitly permits the ASE state transition from Codec Configured directly to QoS Configured, a remote ASCS server can legally send this notification during the vulnerable window. The fix, applied in commit 52f25c903f, redirects all BAP QoS storage from the potentially-NULL stream->qos pointer to the always-valid embedded ep->qos struct, closing the window entirely. The commit also tightens broadcast sink and source paths to use per-endpoint QoS storage rather than shared pointers.
RemediationAI
Apply the upstream fix available in commit 52f25c903f2926cb1281b50fd79654668e2d483f (https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f), which re-points all BAP QoS storage to the always-valid embedded ep->qos struct and eliminates the NULL dereference. Note that a specific tagged patched release version is not independently confirmed from the available data - the fix exists as an upstream commit and integrators should cherry-pick or wait for the next official Zephyr release incorporating it. As a compensating control where patching is not immediately possible, restrict the device to connecting only to known, trusted ASCS servers by enforcing Bluetooth address allowlisting at the host or controller level; this limits the attack surface to authorized peer devices. Alternatively, if BAP unicast client functionality is not required by the application, disable the CONFIG_BT_BAP_UNICAST_CLIENT Kconfig option at build time to eliminate the vulnerable code path entirely - this has no side effects for devices not using BT LE Audio unicast.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today