Bluetooth Mesh SDK CVE-2026-5706

Two specific conditions must both be satisfied. First, the attacking device must have previously joined the Bluetooth Mesh network - it must hold valid provisioning credentials accepted by the network's provisioner authority; unauthenticated adjacent devices are not able to trigger this vulnerability. Second, the victim node must be a provisioner that has enabled Bluetooth extended advertisement support; provisioner nodes without extended advertisement capability, and all non-provisioner mesh nodes, are not described as impacted. Physical proximity (Bluetooth adjacent range, potentially extended by mesh relay) is also required. Exploitation is limited by these two conditions: the attacker must first breach the provisioning trust boundary, and the target must be a specifically-configured provisioner role rather than any arbitrary mesh participant.

The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H) scores 8.9, reflecting high impact but meaningful preconditions. The adjacent-network vector (AV:A) bounds the attack surface to Bluetooth range, which in mesh deployments can span hundreds of meters via multi-hop relay. The AT:P (attack requirement: Prerequisite) metric is the critical limiting factor: the attacking device must already be provisioned into the same Bluetooth Mesh network, meaning an adversary first needs a valid provisioning credential - either stolen, brute-forced, or obtained through a compromised provisioning authority. This substantially narrows the realistic attacker pool compared to a fully unauthenticated network-reachable flaw. The subsequent-system availability impact (SA:H) reflects that a compromised mesh node (particularly a provisioner) can disrupt or manipulate the broader mesh network. No CISA KEV listing or public POC code has been identified, and the EPSS score is not provided in the input data, making exploitation probability difficult to quantify independently. The combination of network-adjacent reach, high impact, and a meaningful provisioning prerequisite places this as a high-priority patch target for operators of provisioner nodes in production mesh deployments, particularly in industrial or building-automation environments where mesh provisioner nodes are long-lived and difficult to isolate.

An attacker who has obtained provisioning credentials for a target Bluetooth Mesh network - for example, through a previously compromised IoT device or leaked provisioning key - brings a Bluetooth-capable device within radio range of a provisioner node. The attacker crafts extended advertisement PDUs with malformed length fields and broadcasts them into the mesh; when the provisioner's SDK processes the advertisement, the length inconsistency triggers an out-of-bounds write onto the stack. If the attacker controls the overwritten data sufficiently to redirect execution, arbitrary firmware-level code runs on the provisioner with no further interaction required.