Zephyr RTOS EUVD-2026-34322

CONFIG_BT_MESH_OD_PRIV_PROXY_SRV must be explicitly enabled at build time - this is a non-default Bluetooth Mesh configuration governing the On-Demand Private Proxy Server feature; devices not compiled with this option are not vulnerable. The device must be running a production or release build without Zephyr assertions (CONFIG_ASSERT=n or not set), which is the standard firmware shipping profile; assertion-enabled builds abort before the corrupted pointer is used, limiting impact to denial of service rather than arbitrary write. The attacker must be within BLE radio range (typically up to ~100 meters in open environments, less through walls) to deliver the crafted advertising payload. No authentication, pairing, bonding, or prior association with the target device is required - any BLE device capable of transmitting non-connectable advertisements can trigger the flaw. The CVSS PR:L score conflicts with this zero-association requirement and should not be used to gate access-control mitigations.

The raw CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) presents two notable discrepancies with the technical description that analysts must reconcile before relying on it for prioritization. First, the attack vector is scored AV:N (Network) but the mechanism - BLE advertising - requires physical radio proximity of typically 10-100 meters; AV:A (Adjacent Network) would be the more accurate classification. This inflates the apparent network-reachability of the flaw. Second, PR:L (Low Privileges) contradicts the description's explicit statement that 'no pairing or prior association' is required, which corresponds to PR:N. If the vector were corrected to AV:A/PR:N, the score would shift but the qualitative risk profile changes materially: exploitation is physically gated but completely unauthenticated against any device in radio range. EPSS at 0.02% (6th percentile) reflects no current mass exploitation activity, and the flaw is not listed in CISA KEV. However, the combination of zero-interaction exploitation, embedded IoT targets that often lack runtime memory protections, and potential RCE impact elevates practical risk for deployments with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled above what the 6.3 score suggests. The assertion-disabled condition (standard for production firmware) removes the only built-in mitigating safety net.

An attacker carrying a BLE-capable device (e.g., a laptop or Raspberry Pi with a USB BLE adapter) positions themselves within radio range of a Zephyr-based Mesh node running with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled in a release build. The attacker broadcasts a non-connectable BLE advertisement containing a UUID16 AD structure with a crafted length byte set to a value less than 3 (e.g., 0x01), requiring no pairing handshake or prior knowledge of the target device. The malformed PDU triggers the integer underflow in bt_mesh_sol_recv(), the resulting out-of-bounds memory write corrupts heap or stack data, and the device crashes (denial of service) or - depending on memory layout and target architecture - executes attacker-controlled code.