CVE-2026-77685 Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds write

[
  {
    "vendor": "zephyrproject",
    "product": "zephyr",
    "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
    "packageName": "zephyr",
    "defaultStatus": "unaffected",
    "programFiles": [
      "subsys/bluetooth/host/classic/rfcomm.c",
      "subsys/bluetooth/host/rfcomm.c"
    ],
    "programRoutines": [
      {
        "name": "rfcomm_handle_msg"
      },
      {
        "name": "rfcomm_make_uih_msg"
      },
      {
        "name": "rfcomm_send_test"
      }
    ],
    "versions": [
      {
        "version": "1.7.0",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "4.5.0"
      }
    ]
  }
]