CVE-2026-10593: NULL Pointer Dereference

The Zephyr Bluetooth LE Audio Basic Audio Profile BAP unicast client mishandles peer-supplied ASE state notifications. In unicastclientepqosstate subsys/bluetooth/audio/bapunicastclient.c, the handler writes attacker-controlled QoS fields interval, framing, phy, sdu, rtn, latency, pd through the...

PT-2026-53091

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.3.0 Zephyr version 4.3.0 Zephyr version 4.4.0 Description The Bluetooth LE Audio Basic Audio Profile BAP unicast client mishandles state notifications supplied by a peer. In the unicast client ep qos state function...