EUVD-2026-40366Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Over-the-air Bluetooth reach gives AV:A; no auth or interaction (PR:N/UI:N); attacker-controlled headers make it low-complexity; memory disclosure is C:H and faults/DoS are A:H with no integrity impact.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
9DescriptionNVD
The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment (sc=0) always carries a 3-byte time_offset, so its segment-header len must be at least PDU_ISO_SEG_TIMEOFFSET_SIZE (3). isoal_check_seg_header() accepted start segments with len < 3 as valid, and isoal_rx_framed_consume() then computed length = seg_hdr->len - 3 in a uint8_t, underflowing to 253-255 when len is 0-2. That oversized length is passed to isoal_rx_append_to_sdu(), whose copy is clamped only against the destination SDU buffer size, not the source PDU length, so up to ~255 bytes of controller memory beyond the received PDU are copied (via sink_sdu_write_hci()/net_buf_add_mem) into an HCI ISO data packet and delivered to the host. The PDU and its segment headers are entirely attacker-controlled and arrive over the air, reachable through both the CIS and BIS-sync HCI data paths (hci_driver.c) and the vendor data path (ull_iso.c), so a remote CIS peer or a broadcaster the device is synced to can trigger an out-of-bounds read causing information disclosure to the host and potential denial of service (faults or malformed oversized HCI ISO packets). The flaw affects all Zephyr releases since framed ISO reception was introduced in v3.0.0. The fix rejects sc=0 segments with len < 3 in isoal_check_seg_header() and adds a guard before the subtraction in isoal_rx_framed_consume().
AnalysisAI
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets an adjacent attacker leak controller memory to the HCI host and potentially crash the device. A malicious CIS peer or a broadcaster the device is BIS-synced to sends a framed ISO PDU whose start-segment length field is 0-2, causing a uint8_t underflow (len-3 → 253-255) that copies up to ~255 bytes past the received PDU into an HCI ISO packet. Publicly available exploit code exists (SSVC: poc); it is not listed in CISA KEV, and EPSS is low at 0.17%, indicating no evidence of widespread active exploitation.
Technical ContextAI
The affected component is Zephyr's Isochronous (ISO) Adaptation Layer, which reassembles framed ISO PDUs into SDUs for LE Audio / Connected and Broadcast Isochronous Streams (CIS/BIS). Per the Bluetooth Core specification, a framed start segment (sc=0) always carries a 3-byte time_offset, so its segment-header len must be >= PDU_ISO_SEG_TIMEOFFSET_SIZE (3). The root cause is CWE-125 (out-of-bounds read): isoal_check_seg_header() failed to enforce this minimum, and isoal_rx_framed_consume() then computed length = seg_hdr->len - 3 in an unsigned 8-bit variable, wrapping to 253-255 for len 0-2. The oversized length reached isoal_rx_append_to_sdu(), whose copy (sink_sdu_write_hci()/net_buf_add_mem) is bounded only by the destination SDU buffer, not the actual source PDU length, so controller memory beyond the PDU is read and forwarded to the host. CPE cpe:2.3:a:zephyrproject:zephyr identifies the affected package; the flaw is reachable via the CIS and BIS-sync HCI data paths (hci_driver.c) and the vendor data path (ull_iso.c).
RemediationAI
Patch available per vendor advisory: upgrade to the fixed Zephyr release (4.5.0, the upper bound of the EUVD-affected range) or apply commit 28080d80fc8aca30af1dfd1338bd4481b13c7395, which rejects sc=0 start segments with len < 3 in isoal_check_seg_header() and adds a guard before the len-3 subtraction in isoal_rx_framed_consume(); see GHSA-6gvp-pmh8-fjh2 (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6gvp-pmh8-fjh2). Confirm the exact patched tag for your maintenance branch since the description says the flaw dates to v3.0.0 while EUVD lists 3.3.0 as the lower bound. If you cannot rebuild firmware immediately, compensating controls are limited because the bug is in over-the-air ISO reception: disable or do not enable Bluetooth Isochronous / LE Audio (CIS and BIS-sync) support in the controller build if the product does not require it, and avoid syncing to untrusted broadcasters or accepting CIS connections from untrusted peers - the trade-off is loss of LE Audio functionality. Where feasible, restrict device operation to trusted RF environments given the adjacent attack vector.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today