EUVD-2026-94230Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessApproach target within Bluetooth range
-
DeliveryCraft Solicitation PDU padded past 17 octets
-
ExploitBroadcast non-connectable mesh advertisement
-
ExecutionHandler copies oversized PDU to stack buffer
-
PersistOverwrite adjacent stack memory
-
ImpactCrash or execute attacker code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target node must be built with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled AND be currently eligible to be solicited - specifically GATT Proxy disabled and On-Demand Private Proxy enabled; nodes without this feature or not in a solicitable state are unaffected, making this a non-default configuration requirement. The attacker must be within Bluetooth Low Energy radio range (AV:A adjacency) to deliver the crafted non-connectable advertisement, but needs no pairing, bonding, provisioning, authentication, or key material since the vulnerable copy runs before decryption (PR:N, unauthenticated). The main limiting factors are therefore physical/radio proximity and the specific mesh proxy configuration, not any credential or user interaction. |
| Impact | This is a genuine high-priority issue for the specific population of devices that run the vulnerable configuration, though its blast radius is constrained by the attack vector. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.8) is well-supported by the source evidence: the copy via net_buf_simple_add_mem into a NET_BUF_SIMPLE(17) stack buffer occurs before any decryption or authentication (PR:N confirmed), the attacker only needs to append trailing AD structures to exceed 17 octets (AC:L is reasonable), and a stack overwrite of attacker-controlled bytes plausibly yields RCE (C:H/I:H/A:H). The vector is Adjacent (AV:A), not Network - exploitation requires Bluetooth radio range, which meaningfully limits mass/remote exploitation. No EPSS score, KEV listing, or public POC was provided: exploitation status is 'no public exploit identified at time of analysis,' so there is no evidence of active exploitation. The practical risk is further gated by a non-default build/runtime configuration (CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled, GATT proxy disabled, On-Demand Private Proxy enabled, node eligible to be solicited). Net: a real, patch-now bug for affected mesh deployments, but not an internet-wide emergency - the adjacency requirement and narrow config profile make it closer to a targeted/proximity threat than a wormable one. RCE via this overflow is described as 'plausible' rather than demonstrated; reliable DoS is the confirmed minimum impact. |
| Exploit ScenarioDerived | An attacker within Bluetooth radio range of a Zephyr node that has On-Demand Private Proxy Server enabled broadcasts a non-connectable advertisement carrying a crafted Mesh Proxy Solicitation, appending extra AD structures or padding so the remaining buffer length exceeds 17 octets. When the solicitation handler copies the oversized PDU into the fixed 17-byte stack buffer, it overwrites adjacent stack memory with attacker-controlled bytes, causing at minimum a reliable crash (DoS) and plausibly remote code execution. No pairing, bonding, provisioning, or key material is required; no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A stack-based buffer overflow in Zephyr's Bluetooth Mesh On-Demand Private Proxy solicitation handler lets any BLE device within radio range overwrite a target node's stack with attacker-controlled bytes by sending a non-connectable advertisement carrying an oversized mesh Proxy Solicitation. Exploitation requires no pairing, bonding, provisioning, or key material because the vulnerable copy happens before decryption, but it is limited to nodes built with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV that are currently eligible to be solicited (GATT Proxy disabled, On-Demand Private Proxy enabled) and physically within BLE range (CVSS 8.8, AV:A/PR:N/C:H/I:H/A:H, unauthenticated). Impact ranges from a reliable remote denial of service to plausible remote code execution; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor fix is available.
RemediationAI
Apply the vendor patch: the upstream fix trims buf->len to the fixed 17-octet Solicitation PDU length in bt_mesh_sol_recv() before sol_pdu_decrypt() runs, so update to a Zephyr revision containing commit 4416ad13677259d180f35ce44338578694e48184 or later, per advisory GHSA-x37p-38wq-cgwj. Where the patch cannot be deployed immediately, the most effective compensating control is to rebuild without CONFIG_BT_MESH_OD_PRIV_PROXY_SRV, which removes the vulnerable code path entirely - the trade-off is loss of the On-Demand Private Proxy feature for that node. Alternatively, keep the GATT Proxy enabled so the node is never in the solicitable state that the buggy handler serves; this avoids the vulnerable code but changes provisioning and proxy behavior and may break deployments that rely on On-Demand Private Proxy toggling. Because the attack vector is unauthenticated raw BLE advertising (AV:A, PR:N), credential-based controls are ineffective; physical/RF controls such as reducing node transmit range, site RF containment, and BLE monitoring for anomalous non-connectable advertisements carrying Solicitation Service Data can only reduce likelihood, not eliminate the flaw. Note that only a subset of affected nodes is exploitable at any given time, so prioritizing patched firmware rollouts to devices that use On-Demand Private Proxy with GATT Proxy disabled gives the best risk reduction per unit of effort.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow in Zephyr's Bluetooth Mesh stack (subsys/bluetooth/mesh/solicitation.c). In sol_pdu_decrypt(), the output buffer is declared as NET_BUF_SIMPLE(17) on the stack, and the received PDU is copied into it with net_buf_simple_add_mem(out, in->data, in->len). net_buf_simple_add() only enforces available tailroom via __ASSERT_NO_MSG, which is compiled out of production builds, so whenever in->len exceeds 17 the underlying memcpy writes past the 17-byte stack region. The oversized length originates upstream in the BLE scan path: bt_mesh_scan_cb() is registered directly as the raw, unauthenticated scan callback, and subsys/bluetooth/mesh/adv.c calls net_buf_simple_restore() before dispatching to bt_mesh_sol_recv(). This leaves buf->len covering the entire remaining advertising payload instead of just the Solicitation Service Data, so after the parser consumes the Service Data AD and the Identification Type byte, buf->len equals the 17-octet Network PDU plus any trailing advertising bytes or AD structures an attacker appends. Prior to the fix only a minimum-length check existed, and because the copy occurs before any decryption or authentication, no mesh keys are needed to trigger the overflow. The repair trims buf->len to the specification-mandated 17 octets (dropping the PDU if fewer remain) before decryption, restoring the invariant that the fixed-size stack buffer can never be overrun.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Over-the-air BLE advertising gives AV:A; trivial padding to exceed 17 octets is AC:L; pre-decryption copy needs no keys so PR:N/UI:N; attacker-controlled stack overwrite plausibly yields full C:H/I:H/A:H.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
DescriptionCVE.org
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In sol_pdu_decrypt(), out is allocated as NET_BUF_SIMPLE(17) and then filled with net_buf_simple_add_mem(out, in->data, in->len); net_buf_simple_add() guards its tailroom only with __ASSERT_NO_MSG, which is compiled out in production builds, so when in->len > 17 the underlying memcpy writes attacker-controlled bytes past the 17-byte stack buffer. The copy occurs before any decryption or authentication, so no key material is required to trigger it.
The oversized length arises because the mesh scan callback in subsys/bluetooth/mesh/adv.c calls net_buf_simple_restore() before dispatching to bt_mesh_sol_recv(), leaving buf->len covering the entire remaining advertising payload rather than just the Solicitation Service Data. After the parser locates the Service Data AD and consumes the Identification Type byte, the remaining buf->len is the 17-octet Network PDU plus any trailing advertising bytes, and prior to this fix there was no maximum-length check (only a minimum). An attacker can therefore append extra AD structures or padding after the Solicitation Service Data to make buf->len exceed 17.
bt_mesh_scan_cb() is registered directly as the BLE scan callback, so buf is raw, unauthenticated advertising data received over the air. Any device in radio range can send a non-connectable advertisement carrying a crafted mesh Proxy Solicitation to a node that has CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled and is currently eligible to be solicited (GATT proxy disabled, On-Demand Private Proxy enabled), with no pairing, bonding, or provisioning. The result is an attacker-controlled stack overwrite - plausibly leading to remote code execution and at minimum a reliable remote denial of service. The fix trims buf->len to the spec-fixed 17 octets (dropping the PDU if fewer remain) before decryption.
Technical POC Analysis
Stack-based buffer overflow (CWE-121; the advisory also tags CWE-787) in the Bluetooth Mesh On-Demand Private Proxy solicitation receive path.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A pre-authentication stack buffer overflow in the Zephyr real-time operating system's Bluetooth Mesh On-Demand Private Proxy service allows any BLE device physically within radio range to corrupt memory on affected mesh nodes without pairing, bonding, or keys. Only nodes built with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV and currently in a solicitable state are exposed, but for those devices the outcome spans reliable remote denial of service to plausible remote code execution. Leadership should care because this affects deployed embedded and IoT fleets in physically accessible environments, where remediation requires coordinated firmware updates rather than routine IT patching. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor fix is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB