EUVD-2026-43190Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
BLE constrains vector to adjacent; AC:H due to concurrent-connection race and large-MTU configuration prerequisites; no privileges on target needed since attacker is a BLE peripheral.
Primary rating from Vendor (zephyrproject).
CVSS VectorVendor: zephyrproject
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a single file-static net_buf_simple (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512 bytes) shared by all connection instances, while the BUSY flag, long-read handle, and reset/offset state were per-connection.
When the device acts as a Broadcast Assistant connected to multiple Scan Delegator peripherals, notification and long-read callbacks from different connections interleave on the shared buffer: the append in notify_handler (net_buf_simple_add_mem at the not-busy branch) performs no tailroom check, so receive-state notifications from two or more delegators accumulate on the same 512-byte buffer and, with a sufficiently large configured ATT MTU (BT_L2CAP_TX_MTU up to 2000) and two-to-three concurrent connections, write past the buffer into adjacent .bss (net_buf_simple_add only asserts in debug builds).
Even below the overflow threshold, one connection's net_buf_simple_reset zeroes the shared length while another connection's reassembly and GATT read offset are in flight, mixing one peer's data into another's parse. A malicious or compromised Scan Delegator (or two colluding peers) over BLE can trigger this, causing out-of-bounds writes (memory corruption / denial of service) and cross-connection data corruption.
The fix moves the buffer into the per-connection instance struct so each connection reassembles into its own buffer. Affects Zephyr releases shipping the Broadcast Assistant with the shared buffer, including v4.4.0 and earlier.
AnalysisAI
Out-of-bounds write in Zephyr RTOS's Bluetooth BAP Broadcast Assistant (subsys/bluetooth/audio/bap_broadcast_assistant.c v4.4.0 and earlier) allows a BLE-adjacent attacker operating one or more malicious Scan Delegator peripherals to corrupt the target device's memory or cause a denial of service. The root cause is a file-static 512-byte att_buf (net_buf_simple) shared across all connection instances: when the Broadcast Assistant holds two or more concurrent BLE connections, concurrent GATT notification callbacks interleave writes into this buffer without tailroom checks, enabling writes past the BSS boundary into adjacent memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires four concurrent conditions: (1) the target device must be built with CONFIG_BT_BAP_BROADCAST_ASSISTANT enabled and operating in the Broadcast Assistant role; (2) the device must have established two or more simultaneous BLE connections to Scan Delegator peripherals; (3) BT_L2CAP_TX_MTU must be configured sufficiently large (up to 2000 bytes) so that accumulated notification payloads across connections can exceed the 512-byte att_buf - below this threshold, the cross-connection data-mixing defect still applies but OOB write does not; (4) the attacker must control at least one malicious or compromised Scan Delegator, or two colluding BLE peers, and must be within BLE radio range of the target. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) scores 6.4 (Medium), which is a reasonable representation of the actual risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker within BLE radio range deploys one or more rogue BLE peripherals advertising as Scan Delegators that a target Zephyr device (acting as Broadcast Assistant) connects to simultaneously. The rogue delegators send crafted, large Broadcast Receive State notifications timed to interleave across the two or more concurrent connections, causing the shared att_buf to be appended beyond its 512-byte boundary during concurrent notify_handler callbacks, writing into adjacent .bss memory and crashing the target device's Bluetooth stack or corrupting control structures. … |
| Remediation | The upstream fix is available as commit 0cd61589ff820b6a585c73cb36f1e14b043a2795 in the Zephyr repository (https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795), which moves att_buf from a file-static shared buffer into the per-connection instance struct, eliminating the race condition entirely. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today