EUVD-2026-43190Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
BLE constrains vector to adjacent; AC:H due to concurrent-connection race and large-MTU configuration prerequisites; no privileges on target needed since attacker is a BLE peripheral.
Primary rating from Vendor (zephyrproject).
CVSS VectorVendor: zephyrproject
Lifecycle Timeline
2DescriptionCVE.org
The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a single file-static net_buf_simple (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512 bytes) shared by all connection instances, while the BUSY flag, long-read handle, and reset/offset state were per-connection.
When the device acts as a Broadcast Assistant connected to multiple Scan Delegator peripherals, notification and long-read callbacks from different connections interleave on the shared buffer: the append in notify_handler (net_buf_simple_add_mem at the not-busy branch) performs no tailroom check, so receive-state notifications from two or more delegators accumulate on the same 512-byte buffer and, with a sufficiently large configured ATT MTU (BT_L2CAP_TX_MTU up to 2000) and two-to-three concurrent connections, write past the buffer into adjacent .bss (net_buf_simple_add only asserts in debug builds).
Even below the overflow threshold, one connection's net_buf_simple_reset zeroes the shared length while another connection's reassembly and GATT read offset are in flight, mixing one peer's data into another's parse. A malicious or compromised Scan Delegator (or two colluding peers) over BLE can trigger this, causing out-of-bounds writes (memory corruption / denial of service) and cross-connection data corruption.
The fix moves the buffer into the per-connection instance struct so each connection reassembles into its own buffer. Affects Zephyr releases shipping the Broadcast Assistant with the shared buffer, including v4.4.0 and earlier.
AnalysisAI
Out-of-bounds write in Zephyr RTOS's Bluetooth BAP Broadcast Assistant (subsys/bluetooth/audio/bap_broadcast_assistant.c v4.4.0 and earlier) allows a BLE-adjacent attacker operating one or more malicious Scan Delegator peripherals to corrupt the target device's memory or cause a denial of service. The root cause is a file-static 512-byte att_buf (net_buf_simple) shared across all connection instances: when the Broadcast Assistant holds two or more concurrent BLE connections, concurrent GATT notification callbacks interleave writes into this buffer without tailroom checks, enabling writes past the BSS boundary into adjacent memory. No public exploit has been identified and exploitation requires high attack complexity, but the memory corruption primitive is serious for embedded/IoT targets where crash recovery may be unavailable.
Technical ContextAI
Zephyr RTOS is an open-source real-time operating system for constrained embedded and IoT devices (RTOS kernel, networking, and Bluetooth stacks). The vulnerability resides in the Bluetooth Audio Profile (BAP) Broadcast Assistant role, implemented in subsys/bluetooth/audio/bap_broadcast_assistant.c. The Broadcast Assistant acts as a GATT client that reads and reassembles Broadcast Receive State characteristic notifications from Scan Delegator peripherals over BLE. The defective design used a single file-static net_buf_simple called att_buf (BT_ATT_MAX_ATTRIBUTE_LEN = 512 bytes) to reassemble multi-fragment ATT reads across all active connection instances, while per-connection state (BUSY flag, long-read handle, offset) was correctly scoped per-connection. CWE-787 (Out-of-Bounds Write) describes this class: the notify_handler's net_buf_simple_add_mem append path performed no tailroom check, and with ATT MTU configured up to BT_L2CAP_TX_MTU = 2000 bytes across two or three concurrent connections, accumulated notification payloads exceed the 512-byte buffer and write into adjacent .bss memory. The assert guard in net_buf_simple_add fires only in debug builds, leaving production devices unprotected. A secondary impact is cross-connection data corruption even below overflow threshold: one connection's net_buf_simple_reset zeroes the shared length while another connection's reassembly is in flight, interleaving one peer's data into another connection's parse context. The fix (commit 0cd61589) moves att_buf into the per-connection instance struct.
RemediationAI
The upstream fix is available as commit 0cd61589ff820b6a585c73cb36f1e14b043a2795 in the Zephyr repository (https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795), which moves att_buf from a file-static shared buffer into the per-connection instance struct, eliminating the race condition entirely. A patched tagged release version is not independently confirmed from the provided references - project maintainers and downstream SDK vendors (Nordic nRF Connect SDK, STM32 Cube, etc.) should be consulted for their respective patched release versions. Organizations unable to update immediately should consider disabling CONFIG_BT_BAP_BROADCAST_ASSISTANT at build time if the Broadcast Assistant role is not operationally required - this eliminates the vulnerable code path entirely with no functional side effects for non-BAP deployments. As a secondary compensating control, reducing BT_L2CAP_TX_MTU to the minimum required for the application (ideally at or below 512 bytes) limits the per-notification payload size, preventing the overflow threshold from being reached even with multiple concurrent connections; however, this does not eliminate the cross-connection data-mixing defect below the overflow boundary. Restricting simultaneous Scan Delegator connections to one at a time in application logic also prevents the interleave condition, at the cost of reduced multi-source audio scanning capability. Refer to the GitHub Security Advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-73c7-3rh7-v5p9 for official guidance.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today