Zephyr Bluetooth Host CVE-2026-85034

Exploitation requires: (1) Bluetooth radio proximity (AV:A); (2) the victim device has already connected to and subscribed to the attacker's GATT server - i.e. a malicious, spoofed or compromised server on a subscribed handle; and (3) a non-default build whose negotiated ATT MTU exceeds 515 octets, meaning CONFIG_BT_L2CAP_TX_MTU and CONFIG_BT_BUF_ACL_RX_SIZE are raised for full-length attribute support - the shipped defaults (27/69/70/200/265) are too small to reach the overflow. The concrete out-of-bounds write is scoped to a subscriber sizing its buffer to the 512-octet spec limit: the in-tree LE Audio unicast client (unicast_client_ep_notify) and BAP Broadcast Assistant (notify_handler), plus any out-of-tree spec-sized subscriber; other in-tree subscribers (tbs_client, mcc) clamp and are not affected. CONFIG_NET_BUF_HARDENING is off by default, so production builds perform the copy rather than asserting. Limiting factors: adjacency, an established subscription relationship, and the atypical high-MTU configuration all substantially narrow real-world exposure below the raw CWE-787 severity.

This is a genuine memory-corruption flaw but a conditional, lower-tier priority rather than a drop-everything emergency, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H, 6.7 Medium) already encodes the two biggest limiters: AV:A means the attacker must be within Bluetooth radio range, and AC:H reflects that a concrete out-of-bounds write only occurs on non-default builds whose ATT MTU exceeds 515 octets (CONFIG_BT_L2CAP_TX_MTU and CONFIG_BT_BUF_ACL_RX_SIZE raised for full-length attribute support) - the shipped Zephyr defaults (27/69/70/200/265) are far smaller and are not exploitable into the overflow. PR:L reflects that the attacker must already be a peer the victim has connected to and subscribed to (a malicious, spoofed or compromised GATT server). No EPSS score, KEV listing, or public exploit is present in the input, so there is no evidence of active exploitation; the only exploitation framework signal is the vendor's own 'this_month' priority label, which aligns with a serious-but-not-critical, config-dependent bug. The vuln.today priority of this_month and the Medium CVSS agree. Net: real and worth patching on a normal cycle, but realistic risk is bounded to proximity, an established subscription, and an atypical high-MTU LE Audio (or out-of-tree 512-byte-subscriber) build.

A device running a vulnerable Zephyr LE Audio unicast client (or BAP Broadcast Assistant), built with an ATT MTU above 515 octets, connects to and subscribes to a GATT server that is attacker-controlled, spoofed, or compromised and within Bluetooth range. The malicious server sends a Handle Value Notification/Indication whose value exceeds 512 octets on the subscribed handle; unicast_client_ep_notify() copies it into the 512-byte att_buf with net_buf_simple_add_mem() and no tailroom check, overflowing into the adjacent net_buf_simple fields. No public exploit code is present in the supplied data; AV:A and AC:H mean the attack needs radio proximity, an established subscription, and a non-default large-MTU build.