CVE-2026-85034

The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...

CVE-2026-85034

The Zephyr RTOS Bluetooth host's GATT client is vulnerable to an out-of-bounds write when processing Handle Value Notifications , Indications , or Multiple Handle Value Notifications . The root cause is that bt_att_recv() fails to enforce the negotiated ATT MTU, and the L2CAP channel lacks an rx....

EUVD-2026-115822

The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...