EUVD-2026-51869Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:A because Bluetooth radio proximity is required; PR:N because the remote peer connects and triggers the flaw without any credentials; C:H for full disclosure of protected characteristic values; no integrity or availability impact.
Primary rating from Vendor (zephyr).
CVSS VectorVendor: zephyr
Lifecycle Timeline
2DescriptionCVE.org
Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BT_GATT_PERM_READ, and a Characteristic Value attribute that carries the application-specified security permissions (e.g. BT_GATT_PERM_READ_ENCRYPT / READ_AUTHEN / READ_LESC). The public notify and indicate APIs explicitly accept either attribute, and passing the declaration is the documented, common idiom. Before sending each notification or indication, the host re-checks link security with bt_gatt_check_perm() against params->attr in gatt_notify(), gatt_indicate(), and gatt_notify_multiple_verify_params() (subsys/bluetooth/host/gatt.c).
When the application passed the Characteristic Declaration attribute, the host correctly redirected the value handle but left params->attr pointing at the declaration, so the security check evaluated the declaration's permissions (no security required) instead of the value's. As a result the encryption/authentication/LESC requirement configured on the characteristic value was skipped. The Notify-Multiple path additionally used a mask that omitted the LE Secure Connections requirement.
A remote peer triggers the disclosure by connecting (optionally without pairing or encryption) and writing the Client Characteristic Configuration descriptor to enable notifications or indications, causing the server to emit the protected value over a link that has not reached the required security level. The impact is information disclosure / access-control bypass for characteristic values the application intended to expose only over a secured link; exposure depends on the application declaring encrypt/authen-required notify/indicate characteristics and on the CCC being writable at a lower security tier. There is no memory-safety or availability impact.
The fix adds bt_gatt_attr_resolve_value(), which maps a declaration attribute to the following value attribute before the permission check, and switches the Notify-Multiple path to the full BT_GATT_PERM_READ_ENCRYPT_MASK so the LESC requirement is also enforced.
AnalysisAI
Bluetooth GATT notification and indication paths in Zephyr RTOS 2.6.0 through 4.4.x skip the application-configured encryption, authentication, and LESC security requirements for characteristic values when the application follows the documented idiom of passing the Characteristic Declaration attribute to the notify/indicate APIs. A remote Bluetooth peer within radio range can connect without pairing and trigger the server to emit protected characteristic values over an unsecured link by writing the Client Characteristic Configuration descriptor, achieving an access-control bypass and information disclosure. No public exploit is identified at time of analysis; exploitation requires adjacent network access and specific application configuration.
Technical ContextAI
Zephyr RTOS implements the Generic Attribute Profile (GATT) per the Bluetooth Core Specification in subsys/bluetooth/host/gatt.c (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*). Each GATT characteristic is stored as two consecutive entries in the attribute table: a Characteristic Declaration (UUID BT_UUID_GATT_CHRC) whose permissions are hard-coded to BT_GATT_PERM_READ, immediately followed by the Characteristic Value attribute that carries the application-specified security flags such as BT_GATT_PERM_READ_ENCRYPT, BT_GATT_PERM_READ_AUTHEN, or the LESC variant. The bt_gatt_notify_cb(), bt_gatt_indicate(), and gatt_notify_multiple_verify_params() functions each call bt_gatt_check_perm() against params->attr to enforce link security before sending data. When params->attr references the declaration (the documented and common idiom), the check evaluates the declaration's unconditional read permission rather than the value's security requirement, silently bypassing the intended access control. The Notify-Multiple path had an additional defect: the permission mask omitted the LE Secure Connections bit. Root cause is CWE-863 (Incorrect Authorization): the authorization decision operates on the wrong attribute object.
RemediationAI
Upgrade to Zephyr 4.5.0 or later, which incorporates the upstream fix from commit c3386f92fe81bd10dc23e6a115e6a80a7d863546 (https://github.com/zephyrproject-rtos/zephyr/commit/c3386f92fe81bd10dc23e6a115e6a80a7d863546). The fix introduces bt_gatt_attr_resolve_value(), which maps any Characteristic Declaration attribute to the immediately following Characteristic Value attribute before bt_gatt_check_perm() is invoked in gatt_notify_cb(), gatt_indicate(), and gatt_notify_multiple_verify_params(), and also expands the Notify-Multiple permission mask to BT_GATT_PERM_READ_ENCRYPT_MASK to enforce LESC requirements. For applications unable to upgrade immediately, two workarounds are available: first, modify application code to pass the Characteristic Value attribute pointer directly to bt_gatt_notify_cb() and bt_gatt_indicate() rather than the declaration pointer, which avoids the mis-checked path entirely; second, require pairing or bonding before the CCC descriptor itself is writable, preventing unauthenticated peers from enabling notifications in the first place. The second workaround has the trade-off of restricting CCC access to paired devices only, which may affect usability in open-advertising scenarios. See the advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4w3r-v9q9-4462.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today