EUVD-2026-35353Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCome within BLE radio range
-
DeliveryEstablish L2CAP LE CoC channel
-
ExploitSend crafted segmented SDU
-
ExecutionOverrun 2-byte counter in net_buf user_data
-
PersistCorrupt adjacent heap
-
ImpactFatal error / device crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of: (1) the target firmware is built with the Zephyr BLE host and L2CAP LE CoC in use; (2) the application enables SDU segmentation by providing the chan_ops.alloc_buf callback; and (3) the RX net_buf pool selected for reassembly declares a user_data_size smaller than 2 bytes - this specific undersized-pool configuration is the precise precondition, not a default guarantee. Given the RF nature, the attacker must also be within Bluetooth (adjacent, AV:A) range and be able to establish an L2CAP CoC channel. Limiting factors: the flaw does not trigger on builds that either omit segmentation or size the RX pool's user_data to >=2 bytes, so it is a configuration-dependent condition rather than a default-configuration bug despite the CVSS PR:N/AC:L rating; no authentication is required per the CVSS vector (PR:N), and no user interaction is needed (UI:N). |
| Impact | Signals point to a real but conditional and low-urgency issue. The published CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H, 8.8) reflects an adjacent, unauthenticated, no-interaction trigger, but its full C:H/I:H/A:H impact appears optimistic given the described effect is a 2-byte counter overwrite yielding an ASan abort or fatal error - the demonstrated outcome is denial of service/crash, not confirmed confidentiality or code-execution loss. This is corroborated by CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: partial) and by EPSS at 0.01% / 3rd percentile. Crucially, the CVSS vector encodes AC:L and PR:N, yet the description states the write only occurs 'when the application enables segmentation ... and the chosen RX pool has a user_data_size smaller than 2 bytes' - a non-default build/configuration precondition that the base score does not capture; this is a conflict worth flagging to defenders. It is NOT in CISA KEV and no POC is referenced. Net: prioritize patching for products actually shipping the vulnerable segmentation configuration, but this is not a widescale emergency. |
| Exploit ScenarioDerived | An attacker within Bluetooth radio range of a Zephyr device running a vulnerable, segmentation-enabled BLE application connects as an unauthenticated L2CAP LE CoC peer and sends a segmented SDU that drives the reassembly counter store past the undersized net_buf user_data region. On ASan builds this aborts the device; on production firmware it corrupts adjacent heap memory, causing a fatal error or potentially exploitable state. No public POC is referenced, and the adjacent (not remote-internet) attack surface plus non-default build precondition constrain practicality. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 08, 2026
Out-of-bounds heap write in the Zephyr RTOS Bluetooth host allows a remote, unauthenticated BLE peer within radio range to corrupt memory during L2CAP LE Connection-oriented Channel (CoC) SDU reassembly. The flaw affects builds where the application enables SDU segmentation via chan_ops.alloc_buf and selects an RX net_buf pool whose user_data_size is smaller than 2 bytes, causing the reassembly segmentation counter in l2cap_chan_le_recv_seg() to be written past the allocated user_data region. There is no public exploit identified at time of analysis and EPSS probability is negligible (0.01%), so realistic impact is a triggered fatal error / heap corruption rather than demonstrated code execution.
Earlier versions of this analysis (2)
Out-of-bounds write in the Zephyr RTOS Bluetooth host (versions 1.14.0 through 4.3.0) lets a remote, unauthenticated BLE peer corrupt heap memory during L2CAP LE Connection-oriented Channel SDU reassembly. When an application enables SDU segmentation via chan_ops.alloc_buf and provisions an RX net_buf pool whose user_data_size is smaller than 2 bytes, a crafted segmented transfer causes a 2-byte write past the buffer's user_data area in l2cap_chan_le_recv_seg, producing an AddressSanitizer abort or, in production builds, heap corruption and a fatal error. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), but the flaw is reachable pre-authentication over the air within BLE range.
Out-of-bounds write in Zephyr RTOS Bluetooth host stack allows an adjacent unauthenticated BLE peer to corrupt heap memory during L2CAP LE Credit-Based Connection SDU reassembly. The 2-byte OOB write occurs in l2cap_chan_le_recv_seg when applications enable segmentation via chan_ops.alloc_buf with an RX pool whose user_data_size is smaller than 2 bytes, producing AddressSanitizer aborts or fatal heap corruption on production builds. No public exploit identified at time of analysis, and the issue is tracked in upstream advisory GHSA-qrcq-hxwj-mqxm.
RemediationAI
Consult and follow the Zephyr security advisory GHSA-qrcq-hxwj-mqxm (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qrcq-hxwj-mqxm) and upgrade to a fixed Zephyr release once the maintainers designate one; the input data references a GitHub security advisory but not an exact tagged patched version, so treat this as an upstream fix available (advisory/commit) with the released patched version not independently confirmed here - do not rely on an invented version number, verify against the advisory. As an immediate compensating control on affected builds, ensure any RX net_buf pool used for L2CAP CoC reassembly declares a user_data_size of at least 2 bytes (the size needed for the segmentation counter), which removes the overrun without disabling functionality. Alternatively, disable L2CAP CoC SDU segmentation by not supplying the chan_ops.alloc_buf callback if the application does not require large-SDU reassembly, at the cost of losing segmented-SDU support. Where BLE is not needed, disabling the Bluetooth host entirely eliminates exposure. Because the attack vector is adjacent (radio range), physically constraining or shielding device RF exposure reduces but does not eliminate risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable code is in subsys/bluetooth/host/l2cap.c, part of Zephyr's Bluetooth Low Energy host stack. L2CAP LE CoC provides a credit-based flow-controlled channel over which large Service Data Units (SDUs) are fragmented into PDUs and reassembled by the receiver. When an application opts into segmentation by providing a chan_ops.alloc_buf callback, the host stores a running segmentation/reassembly counter inside the net_buf 'user_data' scratch area of the RX buffer. Zephyr net_buf pools declare a fixed user_data_size at pool-definition time; if the developer sizes that region below 2 bytes, the 16-bit counter store in l2cap_chan_le_recv_seg overruns the user_data area by 2 bytes into adjacent allocator metadata or buffer memory. This is a classic CWE-787 (Out-of-bounds Write): the length of the write is fixed by the code but the destination buffer is undersized by configuration, so the bounds check that should tie counter storage to user_data_size is effectively absent. On builds with AddressSanitizer the overrun aborts immediately; on production builds it produces heap corruption or a fatal error.
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent unauthenticated BLE trigger (AV:A/PR:N), but requires a non-default undersized-user_data pool with segmentation enabled (AC:H); demonstrated impact is crash/heap corruption (A:H, limited I:L, no confidentiality).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2 bytes, the segmentation counter stored in the net_buf user_data area is written out of bounds in l2cap_chan_le_recv_seg (subsys/bluetooth/host/l2cap.c). The observed effects are an AddressSanitizer abort and, without ASan, heap corruption / fatal error.
Executive ViewAI
A memory corruption vulnerability in Zephyr RTOS Bluetooth stack (CVE-2026-5068, CVSS 8.8) allows unauthenticated wireless peers to trigger heap corruption and device crashes in L2CAP connection handling. Organizations using Zephyr RTOS in IoT or embedded systems should inventory exposure and implement interim mitigations immediately, as no vendor patch is currently available. Exploitation probability is negligible (EPSS 0.01%), but denial-of-service impact on connected device fleets requires urgent assessment.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable L2CAP CoC SDU segmentation at application configuration layer if not operationally required; (2) Configure RX net_buf pools with user_data_size field set to ≥2 bytes; (3) Restrict BLE radio range or implement physical/network-level isolation of vulnerable devices from untrusted peer sources; (4) Deploy runtime monitoring for unexpected device restarts, heap corruption logs, or fatal errors as early-warning indicators of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in Zephyr RTOS Memory Corruption Vulnerabilities
View all 2Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB