CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

CVE-2026-10685

CVE-2026-10685 : In Zephyr, the GATT client CCC-write response handler gatt_write_ccc_rsp() may call the application’s params->subscribe() after already invoking params->notify(conn, params, NULL, 0). A NULL data notify signals termination; calling subscribe() on the same bt_gatt_subscribe_...

CVE-2026-10685: Use After Free

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

PT-2026-66758

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description In the Bluetooth GATT client, the CCC-write response handler gatt write ccc rsp in subsys/bluetooth/host/gatt.c invokes the params-subscribe callback after calling params-notifyconn, params,...

NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2026-0063)

The remote NewStart CGSL host, running version MAIN 6.06, has kernel packages installed that are affected by multiple vulnerabilities: - BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitra...

BLE GATT Characteristics

Enumerates GATT characteristics UUID, handle, properties for a BLE session !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT characteristics and properties.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

BLE GATT Client

Connects to a Bluetooth Low Energy peripheral over GATT and creates a session for service enumeration, read/write, and notify capture !/usr/bin/env python3 -- coding: utf-8 -- """BLE GATT bind listener — connects to a peripheral and opens a GATT session.""" from kittysploit import from...

CVE-2026-10660

The CVE-2026-10660 issue affects the Zephyr Bluetooth BAP Broadcast Assistant GATT client (subsys/bluetooth/audio/bap_broadcast_assistant.c). A single static net_buf_simple buffer (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512) is shared across all connections; per-connection state (BUSY flag, long-rea...

CVE-2026-10660

The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bapbroadcastassistant.c reassembled remote Broadcast Receive State data into a single file-static netbufsimple attbuf, BTATTMAXATTRIBUTELEN = 512 bytes shared by all connection instances, while the BUSY flag, long-read...

PT-2026-57480

The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap broadcast assistant.c reassembled remote Broadcast Receive State data into a single file-static net buf simple att buf, BT ATT MAX ATTRIBUTE LEN = 512 bytes shared by all connection instances, while the BUSY flag,...

CVE-2026-37271: Improper Authentication

Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearb...

CVE-2026-37271

Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearb...

CVE-2026-5768

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities,...

CVE-2026-5768

CVE-2026-5768 concerns the Frontier X2 device and Frontier X mobile app, where unauthenticated BLE read/write access to critical GATT characteristics enables attackers within BLE range to control device functions, trigger vibrations, cause DoS, and forge health telemetry by impersonating devices ...

CVE-2026-5768

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities,...

CVE-2026-5768 Fourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical Function

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities,...

CVE-2026-5768: Missing Authentication for Critical Function

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities,...

CLSA-2026-1777541445 bluez: Fix of 3 CVEs

CVE-2022-0204: fix heap overflow when appending prepare writes in gatt-server - CVE-2022-39176: fix not checking paramslen in AVRCP vendordep PDU handling - CVE-2022-39177: fix accepting invalid/malformed capabilities in AVDTP...

EUVD-2026-8870

Golioth Pouch version 0.1.0 prior to INSERT FIXED VERSION, fixed in commit 1b2219a1, contain a heap-based buffer overflow in BLE GATT server certificate handling. servercertwrite allocates a heap buffer of size CONFIGPOUCHSERVERCERTMAXLEN when receiving the first fragment, then appends subsequent...

CVE-2026-23750 Golioth Pouch (prior to commit 1b2219a1) BLE GATT Heap-based Buffer Overflow

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. servercertwrite allocates a heap buffer of size CONFIGPOUCHSERVERCERTMAXLEN when receiving the first fragment, then appends subsequent fragments using memcpy witho...