EUVD-2026-46449Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconEstablish ACL connection within radio range
-
DeliveryOpen L2CAP channel to SDP (pre-pairing)
-
ExploitSend packed CONF_REQ with len=0
-
InstallUnderflow opt_len to ~0xFFFF
-
C2Option loop walks past ACL buffer
-
ExecuteOut-of-bounds read/write corrupts host memory
-
ImpactDevice crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be running Zephyr with the Bluetooth Classic (BR/EDR) host stack enabled and reachable - the vulnerable code path is only exercised when BR/EDR L2CAP signaling is active and an L2CAP channel to a pre-pairing L0 service such as SDP can be opened without authentication. The attacker must be within Bluetooth radio range (CVSS AV:A) and able to establish an ACL connection; no pairing, encryption, credentials, or user interaction is required (PR:N/UI:N). The specific trigger is a malformed L2CAP signaling PDU containing a CONF_REQ (or CONF_RSP) command whose header length field is smaller than the configuration-request/response structure (e.g. 0), packed together with a second command so buf->len still passes the flawed check. Limiting factors: proximity is required (not Internet-remote), the device must actually implement BR/EDR Classic rather than BLE-only, and reliable memory-corruption-to-code-execution outcomes depend on heap/buffer layout, so denial of service is the most dependable result. |
| Impact | The supplied CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, base 7.6) is internally consistent with the description: exploitation is over the air (Adjacent, i.e. Bluetooth radio range, not full Internet-remote), requires no privileges or user interaction, and the dominant impact is availability (host/device crash) with limited confidentiality/integrity exposure from the memory disclosure/corruption. This is a genuine priority for any device shipping Zephyr with Classic BR/EDR enabled because the signaling channel is reachable pre-pairing/pre-encryption via an L0 service such as SDP, removing the usual authentication barrier. Tempering the urgency: the attacker must be in radio proximity (AV:A, not AV:N), which caps mass/automated exploitation, and no EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation - realistic risk today is DoS by a nearby attacker rather than reliable remote code execution. The C:L/I:L rating reflects that the OOB write is data-dependent (only via MTU/flush-timeout option bytes) rather than a fully controlled write primitive; treat RCE as plausible-but-unproven from the available data. |
| Exploit ScenarioDerived | An attacker within Bluetooth radio range establishes an ACL connection to a Zephyr device and opens an L2CAP channel to an unauthenticated L0 service like SDP, all before any pairing or encryption. They send a single signaling PDU packing a CONF_REQ command with a header length of 0 followed by a second command, causing opt_len to underflow and the option loop to read/write past the ACL buffer, crashing the device. No public POC is identified at time of analysis, and the low attack complexity (AC:L) means a crafted packet is straightforward to construct once the packing trick is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Out-of-bounds read and write in the Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP signaling handlers (l2cap_br_conf_req/rsp) lets an unauthenticated peer within Bluetooth radio range corrupt host memory and crash the device, affecting released versions including v4.4.0. Because the handlers checked the whole-PDU length (buf->len) instead of the per-command length (len), a packed CONF_REQ with a tiny header length underflows opt_len to ~0xFFFF and walks the option-parsing loop past the pooled ACL receive buffer. No public exploit is identified at time of analysis; a vendor patch and GHSA advisory exist and EPSS/KEV data were not provided.
RemediationAI
Patch available per vendor advisory: apply the upstream fix (commit 1d451683377f4c8e56d7718565bea7b5c1155159), which validates against the per-command len instead of buf->len in both l2cap_br_conf_req() and l2cap_br_conf_rsp(); consult GHSA-vrwx-p97q-8854 for the exact patched release corresponding to your Zephyr baseline, then rebuild and reflash affected firmware. Because a specific tagged fixed-version string was not provided in the input, confirm the patched tag from the advisory before deployment. Where firmware cannot be updated immediately, the most effective compensating control is to disable Bluetooth Classic (BR/EDR) support if the device only needs BLE, or to avoid exposing pre-pairing L0 services such as SDP; note the trade-off that disabling BR/EDR breaks any Classic-profile functionality (e.g. legacy audio/serial profiles). Reducing device discoverability/connectability and physically limiting radio exposure lowers opportunistic risk but does not close the vulnerability, since an attacker who can establish an ACL connection can still reach the signaling channel.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Zephyr's Bluetooth host stack, specifically the Classic BR/EDR L2CAP signaling layer in subsys/bluetooth/host/classic/l2cap_br.c. L2CAP signaling PDUs can carry multiple commands, each prefixed by a code/ident/length header; the correct bound for a single command's payload is the header 'len' field, not buf->len (bytes remaining in the entire PDU). The root cause is CWE-125 (out-of-bounds read): the minimum-size validation used buf->len, so a command declaring length 0 followed by a second command still satisfied the check. The subsequent computation opt_len = len - sizeof(*req) underflows the uint16_t, and the configuration-option loop uses net_buf pull primitives that perform no runtime bounds checking, so parsing runs off the end of the shared ACL receive buffer. When over-read option bytes happen to encode an MTU or flush-timeout option, the handler writes back, escalating the read into an out-of-bounds write. CPE cpe:2.3:a:zephyrproject:zephyr identifies the affected component as the Zephyr project itself.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Adjacent Bluetooth radio range (AV:A) with a simple crafted PDU (AC:L), no pairing/auth or interaction (PR:N/UI:N); memory disclosure/corruption gives C:L/I:L while the reliable outcome is a device crash (A:H).
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
DescriptionCVE.org
The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length from the L2CAP signaling header). Because multiple signaling commands can be packed into one PDU, buf->len may exceed a command's len. An attacker can send a CONF_REQ command with a header length smaller than the configuration-request structure (e.g. 0), followed by another command so that buf->len still satisfies the check. The check then passes incorrectly and opt_len = len - sizeof(*req) underflows the uint16_t to a near-0xFFFF value. The configuration-option loop, which lacks an opt_len-versus-buf->len guard, then walks far past the end of the pooled ACL receive buffer using net_buf pull primitives that perform no runtime bounds check, producing an out-of-bounds read of host memory and, when the out-of-bounds option bytes encode an MTU or flush-timeout option, an out-of-bounds write. The BR/EDR signaling channel is processed before pairing/encryption and an L2CAP channel to an L0 service such as SDP can be opened without pairing, so an unauthenticated peer within radio range that can establish an ACL connection can trigger the flaw, leading to memory corruption and denial of service (host/device crash). The defect is present in released versions including v4.4.0. The fix validates against len instead of buf->len in both handlers.
Executive ViewAI
Zephyr RTOS Bluetooth Classic versions including v4.4.0 contain an out-of-bounds memory corruption vulnerability allowing unauthenticated attackers within Bluetooth radio range to crash devices. This creates denial-of-service risk for organizations deploying Zephyr-based IoT and embedded systems in potentially hostile radio environments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB