Zephyr RTOS EUVD-2026-58131

Exploitation requires the local Zephyr device to act as a GATT client and actively initiate BT_GATT_DISCOVER_STD_CHAR_DESC discovery against a peer - the vulnerable code path in parse_read_std_char_desc() is only reached when the host sends an ATT Read By Type Request for standard characteristic descriptors and then processes the peer's response. GATT discovery is explicitly noted in the description as not requiring bonding or encryption, meaning the CVSS PR:N assignment is confirmed: no pre-established trust, credential, or encrypted session is required. The attacker must be within Bluetooth adjacency range and able to control or impersonate a GATT server that the target device connects to. Exploitation is constrained to the Bluetooth adjacency network vector (AV:A); remote internet-based exploitation is not possible. Devices that never act as GATT clients, never initiate descriptor discovery, or that have CONFIG_BT_GATT_CLIENT disabled at compile time are not reachable via this code path.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scoring 6.5 is well-calibrated to the actual threat: Bluetooth adjacency bounds the attack surface to roughly 10-100 meters, eliminating internet-scale exploitation, but within that range the attack is trivially low complexity and requires no authentication, credentials, or user interaction. The high availability impact accurately reflects that a hung host processing thread disables the entire BT subsystem. On severely constrained embedded targets, a watchdog reset compounds the impact by causing device reboots. No EPSS score was included in the input data, preventing quantitative exploitation-probability comparison; this gap should be resolved before prioritization decisions are finalized. The absence of a KEV listing and of identified POC code suggests no active widespread exploitation at time of analysis, though even a mid-sized municipal IT team in gliwice deploying Zephyr-based BLE devices in a public space should treat this as urgent given that the publicly available commit diff and security advisory fully disclose the vulnerable code path and fix logic, making independent exploit development straightforward. The wildcard CPE indicates NVD has not bounded the affected version range, which is a notable data gap: defenders cannot confirm whether they are on an unaffected release without checking the specific commit.

An attacker operating a rogue BLE peripheral or modified BLE stack within Bluetooth range waits for or induces the target Zephyr device to connect and initiate GATT standard-descriptor-value discovery. The attacker responds to the ATT Read By Type Request with a crafted response containing rsp->len = 0, causing the Zephyr Bluetooth host processing thread to enter an infinite re-parse loop. The BT subsystem hangs, and on constrained targets a watchdog reset occurs, interrupting all Bluetooth functionality until the device reboots.