EUVD-2026-35353Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent unauthenticated BLE trigger (AV:A/PR:N), but requires a non-default undersized-user_data pool with segmentation enabled (AC:H); demonstrated impact is crash/heap corruption (A:H, limited I:L, no confidentiality).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2 bytes, the segmentation counter stored in the net_buf user_data area is written out of bounds in l2cap_chan_le_recv_seg (subsys/bluetooth/host/l2cap.c). The observed effects are an AddressSanitizer abort and, without ASan, heap corruption / fatal error.
AnalysisAI
Out-of-bounds heap write in the Zephyr RTOS Bluetooth host allows a remote, unauthenticated BLE peer within radio range to corrupt memory during L2CAP LE Connection-oriented Channel (CoC) SDU reassembly. The flaw affects builds where the application enables SDU segmentation via chan_ops.alloc_buf and selects an RX net_buf pool whose user_data_size is smaller than 2 bytes, causing the reassembly segmentation counter in l2cap_chan_le_recv_seg() to be written past the allocated user_data region. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.01%), so realistic impact is a triggered fatal error / heap corruption rather than demonstrated code execution.
Technical ContextAI
The vulnerable code is in subsys/bluetooth/host/l2cap.c, part of Zephyr's Bluetooth Low Energy host stack. L2CAP LE CoC provides a credit-based flow-controlled channel over which large Service Data Units (SDUs) are fragmented into PDUs and reassembled by the receiver. When an application opts into segmentation by providing a chan_ops.alloc_buf callback, the host stores a running segmentation/reassembly counter inside the net_buf 'user_data' scratch area of the RX buffer. Zephyr net_buf pools declare a fixed user_data_size at pool-definition time; if the developer sizes that region below 2 bytes, the 16-bit counter store in l2cap_chan_le_recv_seg overruns the user_data area by 2 bytes into adjacent allocator metadata or buffer memory. This is a classic CWE-787 (Out-of-bounds Write): the length of the write is fixed by the code but the destination buffer is undersized by configuration, so the bounds check that should tie counter storage to user_data_size is effectively absent. On builds with AddressSanitizer the overrun aborts immediately; on production builds it produces heap corruption or a fatal error.
RemediationAI
Consult and follow the Zephyr security advisory GHSA-qrcq-hxwj-mqxm (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qrcq-hxwj-mqxm) and upgrade to a fixed Zephyr release once the maintainers designate one; the input data references a GitHub security advisory but not an exact tagged patched version, so treat this as an upstream fix available (advisory/commit) with the released patched version not independently confirmed here - do not rely on an invented version number, verify against the advisory. As an immediate compensating control on affected builds, ensure any RX net_buf pool used for L2CAP CoC reassembly declares a user_data_size of at least 2 bytes (the size needed for the segmentation counter), which removes the overrun without disabling functionality. Alternatively, disable L2CAP CoC SDU segmentation by not supplying the chan_ops.alloc_buf callback if the application does not require large-SDU reassembly, at the cost of losing segmented-SDU support. Where BLE is not needed, disabling the Bluetooth host entirely eliminates exposure. Because the attack vector is adjacent (radio range), physically constraining or shielding device RF exposure reduces but does not eliminate risk.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today