Zephyr RTOS CVE-2026-10641

Target must be a Zephyr build with CONFIG_BT_HFP_HF enabled and acting in the HFP Hands-Free role, performing Service Level Connection setup with the attacker's Audio Gateway over Bluetooth Classic (BR/EDR). The attacker must be within Bluetooth radio range and able to complete enough of the HFP SLC handshake to deliver an AT+CIND=? response containing more than 20 recognized indicator entries; no user interaction, no pairing prompt acceptance beyond what the device's normal HFP flow already permits, and no authentication on the HFP layer are required (PR:N, UI:N). Limiting factors: adjacent (not network) attack vector, requires Bluetooth Classic radio (not BLE), requires the device to connect to or accept connection from the attacker's AG, and is only present in builds compiling the HFP HF subsystem.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (7.1 High) is consistent with the description: exploitation is adjacent (Bluetooth range), unauthenticated, requires no user interaction, and is primarily an availability (DoS of the Bluetooth host) and limited integrity issue, with no direct confidentiality impact because the write is of an attacker-positioned but small index value. EPSS and CISA KEV status are not provided in the input; no public exploit identified at time of analysis, so this should be treated as a credible DoS / memory-corruption risk rather than confirmed in-the-wild exploitation. Real-world risk is gated by deployment: only builds with CONFIG_BT_HFP_HF enabled and HFP HF role active are vulnerable, and the attacker must be within Bluetooth Classic range and able to complete an SLP-level connection as the AG, which limits mass exploitation but is highly relevant for headset, automotive, and wearable Zephyr devices. The vector says C:N but the description notes corruption of adjacent struct fields including pointers/bookkeeping - code execution potential is theoretical and not asserted by the CVSS, so escalation beyond DoS should be considered possible but unverified.

An attacker within Bluetooth Classic range stands up a rogue or compromised Audio Gateway (e.g., spoofed car kit or headset peer) and waits for, or coerces, a Zephyr-based device with HFP HF enabled to initiate the standard Service Level Connection. When the HF sends AT+CIND=?, the malicious AG responds with a crafted +CIND: list containing many more than 20 recognized indicator entries, causing cind_handle_values() to write past ind_table[] into adjacent struct fields and crash or corrupt the Bluetooth host. No public exploit identified at time of analysis, but the trigger requires only a single malformed AT response and no user interaction.