Zephyr Bluetooth OTS EUVD-2026-109972

The target device must run Zephyr's Bluetooth Object Transfer Service (OTS) server with the OACP characteristic exposed and be connectable/advertising; no pairing, encryption, or authentication is required (BT_GATT_PERM_WRITE / BT_GATT_PERM_READ|WRITE). The attacker must be within Bluetooth radio range (adjacent, not remote-over-internet). The trigger is a Calculate Checksum (BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC) command that fails validation - e.g. issued with no object selected (returns INV_OBJ) or with invalid offset/len (returns INV_PARAM); because oacp_command_decode() handles the op code unconditionally (no CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT guard), even builds without checksum support are reachable via OPCODE_NOT_SUP. Limiting factors: the denial-of-service panic requires CONFIG_ASSERT to be enabled, while the 4-byte uninitialized-stack disclosure requires assertions to be disabled; adjacent-only vector limits reach to physically nearby attackers; and the disclosure is bounded to four bytes per request with no memory corruption.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1) is consistent with the description: exploitation requires only Bluetooth radio-range (adjacent) access, low complexity, and no authentication (PR:N), because the OACP characteristic and its CCC are declared BT_GATT_PERM_WRITE / BT_GATT_PERM_READ|WRITE with no pairing or encryption. The dominant impact is availability (A:H) via a remotely triggered kernel panic on CONFIG_ASSERT-enabled builds, plus low confidentiality (C:L) from four bytes of uninitialized stack disclosure on asserts-disabled builds. The vuln.today Decision label is 'this_week', which aligns with a real-but-not-critical adjacent-only flaw. No EPSS score was provided, so statistical exploitation probability cannot be weighed. KEV status is not indicated in the input, so there is no evidence of active exploitation - treat it as not currently KEV-listed. A detailed PoC/reproduction is described in the vendor GHSA advisory (runtime-reproduced crash on mps2/an385, Zephyr v4.3.0, with a 9-byte crashing input), raising practical risk above a theoretical finding, though the attack is bounded (adjacent vector, 4-byte disclosure per request, no memory corruption). The main limiter on real-world urgency is that it only affects devices actually running Zephyr's optional OTS server with the OACP characteristic exposed and connectable.

An attacker within Bluetooth radio range connects to a device running Zephyr's OTS server, enables OACP indications, and sends a nine-byte Calculate Checksum command that fails validation (for example with no object selected). On an assertion-enabled build this trips net_buf_simple_pull_mem() and panics the device (denial of service); on an assertion-disabled build it returns four bytes of uninitialized stack memory in the indication, repeatable on every request. The vendor GHSA advisory documents a runtime-reproduced PoC for the panic.