91 matches found
CVE-2026-9263 Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets
The Zephyr Bluetooth controller ISO Adaptation Layer subsys/bluetooth/controller/llsw/isoal.c fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment sc=0 always carries a 3-byte timeoffset, so its segment-header len must be at least...
PT-2026-53936
The Zephyr Bluetooth controller ISO Adaptation Layer subsys/bluetooth/controller/ll sw/isoal.c fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment sc=0 always carries a 3-byte time offset, so its segment-header len must be at least...
CVE-2026-9263: Out-of-bounds Read
The Zephyr Bluetooth controller ISO Adaptation Layer subsys/bluetooth/controller/llsw/isoal.c fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment sc=0 always carries a 3-byte timeoffset, so its segment-header len must be at least...
Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
...
PT-2026-36439
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the hci cmd sync queue once function fails to indicate whether a queue item was added. This prevents the caller from knowing if callbacks...
EUVD-2026-1849
Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affects Apache NimBLE: through 1.8. This issue requires a broken or bogus Bluetooth controller and thus severity is considered low. Users are...
CVE-2025-53477
Apache NimBLE (part of the Apache Mynewt project), an open-source Bluetooth 5.4 stack , is vulnerable to a NULL pointer dereference in its host HCI layer . The flaw is caused by missing validation of HCI connection complete or HCI command TX buffers . This vulnerability affects versions through 1...
CVE-2025-53470: Out-of-bounds Read
Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affects Apache NimBLE: through 1.8. This issue requires a broken or bogus Bluetooth controller and thus severity is considered low. Users are...
CVE-2025-53477: NULL Pointer Dereference
NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low. This issue...
CVE-2025-64342 ESF-IDF's ESP32 Bluetooth Controller Has an Invalid Access Address Vulnerability
ESF-IDF is the Espressif Internet of Things IOT Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address AA of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. In this case, the controller may incorrectly...
CVE-2025-47370
Technical details, affected product/versions, root cause, and fixes for CVE-2025-47370 are not publicly provided in the supplied documents. Monitor for updates from vendors/security bulletins.
CVE-2025-47370 Reachable Assertion in BT Controller
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan...
CVE-2025-47342 Use After Free in BT Controller
Transient DOS may occur when multi-profile concurrency arises with QHS enabled...
CVE-2025-47342
CVE-2025-47342 concerns Qualcomm chipsets where a transient denial-of-service can occur due to concurrency involving QHS and multi-profile configurations. The Red Hat/NVD/CVE records describe the issue as a transient DOS when multiple profiles are used concurrently with QHS enabled; the CVE List ...
CVE-2025-47342 Use After Free in BT Controller
Transient DOS may occur when multi-profile concurrency arises with QHS enabled...
EUVD-2021-19253
Malware in sbrugna...
EUVD-2017-9305
Malware in sbrugna...
EUVD-2021-21773
Malware in sbrugna...