EUVD-2026-40366Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconEnter Bluetooth range of target
-
DeliveryEstablish CIS or force BIS-sync
-
ExploitSend framed ISO PDU with start-segment len<3
-
InstallTrigger uint8_t underflow (len-3
-
C2255)
-
ExecuteOver-read controller memory into HCI ISO packet
-
ImpactLeak memory to host or crash stack (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an active framed ISO data path: either an established Connected Isochronous Stream (CIS) with the attacker as the peer, or the target device synchronized to an attacker-controlled Broadcast Isochronous Stream (BIS-sync); the vendor data path via ull_iso.c is also reachable. The attacker must craft a framed ISO PDU whose start segment (sc=0) has a segment-header len < 3 (values 0-2). No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: the attack vector is Adjacent (AV:A), so the attacker must be within Bluetooth radio range; the device must have Bluetooth ISO / LE Audio framed reception enabled and be running a Zephyr build from the affected range (v3.0.0/3.3.0 through <4.5.0); and an ISO stream must be established or synced, which constrains this to proximity-based, targeted exploitation rather than remote internet-wide attack. |
| Impact | The CVSS 3.1 score of 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) reflects an unauthenticated, low-complexity attack over the Bluetooth radio yielding high confidentiality (memory disclosure) and high availability (faults/DoS) impact, with no integrity impact. This is internally consistent with the description: the PDU and its segment headers are fully attacker-controlled and arrive over the air, requiring only radio proximity and an established/synced ISO stream. Counterweighting signals lower the real-world urgency: the adjacent (not network) attack vector limits reach to Bluetooth range, SSVC rates it Automatable:no with only Partial technical impact, EPSS is 0.17% (7th percentile), and it is absent from CISA KEV. Exploitation status is POC per SSVC, so exploit code or a working technique is public, but there is no evidence of mass exploitation. Net: a genuine, well-characterized memory-safety bug worth prompt patching on Bluetooth/LE-Audio-enabled devices, but the adjacency requirement and low automatability make it a targeted-proximity risk rather than an internet-wide emergency. |
| Exploit ScenarioDerived | An attacker within Bluetooth radio range establishes a CIS connection to the target (or has the target sync to an attacker-controlled BIS broadcast), then transmits a framed ISO PDU whose start-segment header carries a length field of 0, 1, or 2. The uint8_t underflow causes the controller to copy up to ~255 bytes of adjacent controller memory into an HCI ISO data packet delivered to the host, leaking memory contents and potentially faulting the stack. Exploit/POC material is public (SSVC: poc), and no authentication is required (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jul 06, 2026
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets an adjacent attacker leak controller memory to the HCI host and potentially crash the device. A malicious CIS peer or a broadcaster the device is BIS-synced to sends a framed ISO PDU whose start-segment length field is 0-2, causing a uint8_t underflow (len-3 → 253-255) that copies up to ~255 bytes past the received PDU into an HCI ISO packet. Publicly available exploit code exists (SSVC: poc); it is not listed in CISA KEV, and EPSS is low at 0.17%, indicating no evidence of widespread active exploitation.
Earlier versions of this analysis (4)
Out-of-bounds read in the Zephyr RTOS Bluetooth controller ISO Adaptation Layer (isoal.c) lets a proximate attacker leak up to ~255 bytes of controller memory to the host and destabilize the stack. The controller accepts a framed ISO start segment (sc=0) whose segment-header len is below the mandatory 3-byte time_offset size; the subsequent length = len - 3 subtraction underflows in a uint8_t to 253-255, and the resulting copy is clamped only to the destination SDU buffer, not the source PDU, so memory past the received PDU is delivered to the host inside an HCI ISO packet. It affects all Zephyr builds since framed ISO reception was introduced, is reachable over the air via the CIS, BIS-sync, and vendor ISO data paths, and per the SSVC framework carries proof-of-concept maturity while EPSS stays very low (0.17%).
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets a remote, unauthenticated attacker within Bluetooth radio range leak up to ~255 bytes of controller memory to the host and potentially crash the device. A malformed framed ISO PDU start segment with an undersized length field triggers a uint8_t underflow, causing an oversized copy of memory beyond the received PDU into an HCI ISO data packet. It affects every Zephyr release from v3.0.0 onward (EUVD scopes 3.3.0 up to 4.5.0), carries a vendor CVSS of 8.1, and has proof-of-concept status per CISA SSVC though it is not on CISA KEV; publicly available exploit code exists per the SSVC 'poc' rating, and EPSS is low at 0.17%.
Out-of-bounds read in the Zephyr RTOS Bluetooth controller's ISO Adaptation Layer (isoal.c) lets a remote isochronous peer leak up to ~255 bytes of controller memory to the host and potentially crash the device. The flaw sits in framed ISO PDU parsing, where an attacker-controlled start-segment length field underflows a uint8_t and drives an oversized copy into an HCI ISO data packet. Publicly available exploit code exists (SSVC: PoC); it is not listed in CISA KEV, and EPSS is low at 0.17% (7th percentile), consistent with a specialized Bluetooth radio-proximity attack rather than mass exploitation.
Out-of-bounds read in Zephyr RTOS's Bluetooth ISO Adaptation Layer (ISOAL) leaks up to 255 bytes of controller memory to remote Bluetooth peers, affecting all releases since v3.0.0. A crafted framed ISO PDU with an undersized start-segment length field triggers a uint8_t integer underflow in isoal_rx_framed_consume(), causing controller memory beyond the received PDU to be copied into HCI ISO data packets delivered to the host - reachable over both CIS and BIS-sync paths without authentication. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but a vendor patch commit is available upstream.
RemediationAI
Patch available per vendor advisory: upgrade to the fixed Zephyr release (4.5.0, the upper bound of the EUVD-affected range) or apply commit 28080d80fc8aca30af1dfd1338bd4481b13c7395, which rejects sc=0 start segments with len < 3 in isoal_check_seg_header() and adds a guard before the len-3 subtraction in isoal_rx_framed_consume(); see GHSA-6gvp-pmh8-fjh2 (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6gvp-pmh8-fjh2). Confirm the exact patched tag for your maintenance branch since the description says the flaw dates to v3.0.0 while EUVD lists 3.3.0 as the lower bound. If you cannot rebuild firmware immediately, compensating controls are limited because the bug is in over-the-air ISO reception: disable or do not enable Bluetooth Isochronous / LE Audio (CIS and BIS-sync) support in the controller build if the product does not require it, and avoid syncing to untrusted broadcasters or accepting CIS connections from untrusted peers - the trade-off is loss of LE Audio functionality. Where feasible, restrict device operation to trusted RF environments given the adjacent attack vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Zephyr's Isochronous (ISO) Adaptation Layer, which reassembles framed ISO PDUs into SDUs for LE Audio / Connected and Broadcast Isochronous Streams (CIS/BIS). Per the Bluetooth Core specification, a framed start segment (sc=0) always carries a 3-byte time_offset, so its segment-header len must be >= PDU_ISO_SEG_TIMEOFFSET_SIZE (3). The root cause is CWE-125 (out-of-bounds read): isoal_check_seg_header() failed to enforce this minimum, and isoal_rx_framed_consume() then computed length = seg_hdr->len - 3 in an unsigned 8-bit variable, wrapping to 253-255 for len 0-2. The oversized length reached isoal_rx_append_to_sdu(), whose copy (sink_sdu_write_hci()/net_buf_add_mem) is bounded only by the destination SDU buffer, not the actual source PDU length, so controller memory beyond the PDU is read and forwarded to the host. CPE cpe:2.3:a:zephyrproject:zephyr identifies the affected package; the flaw is reachable via the CIS and BIS-sync HCI data paths (hci_driver.c) and the vendor data path (ull_iso.c).
Know when Zephyr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Over-the-air Bluetooth reach gives AV:A; no auth or interaction (PR:N/UI:N); attacker-controlled headers make it low-complexity; memory disclosure is C:H and faults/DoS are A:H with no integrity impact.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment (sc=0) always carries a 3-byte time_offset, so its segment-header len must be at least PDU_ISO_SEG_TIMEOFFSET_SIZE (3). isoal_check_seg_header() accepted start segments with len < 3 as valid, and isoal_rx_framed_consume() then computed length = seg_hdr->len - 3 in a uint8_t, underflowing to 253-255 when len is 0-2. That oversized length is passed to isoal_rx_append_to_sdu(), whose copy is clamped only against the destination SDU buffer size, not the source PDU length, so up to ~255 bytes of controller memory beyond the received PDU are copied (via sink_sdu_write_hci()/net_buf_add_mem) into an HCI ISO data packet and delivered to the host. The PDU and its segment headers are entirely attacker-controlled and arrive over the air, reachable through both the CIS and BIS-sync HCI data paths (hci_driver.c) and the vendor data path (ull_iso.c), so a remote CIS peer or a broadcaster the device is synced to can trigger an out-of-bounds read causing information disclosure to the host and potential denial of service (faults or malformed oversized HCI ISO packets). The flaw affects all Zephyr releases since framed ISO reception was introduced in v3.0.0. The fix rejects sc=0 segments with len < 3 in isoal_check_seg_header() and adds a guard before the subtraction in isoal_rx_framed_consume().
Executive ViewAI
Zephyr RTOS Bluetooth implementations are vulnerable to data disclosure and device crashes from adjacent network attackers. Publicly available exploit code exists, though active exploitation appears limited. This puts at risk the confidentiality and availability of connected IoT and embedded systems across your infrastructure.
Apply vendor patch. If immediate patching not feasible: disable Bluetooth ISO features operationally and restrict device network access to trusted network segments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
An out-of-bounds write in the Zephyr RTOS DNS resolver (dns_unpack_name()) lets a crafted DNS response corrupt memory on
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Exploit-DB