CVE-2026-10680 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

CVE-2026-9263

The Zephyr Bluetooth controller ISO Adaptation Layer subsys/bluetooth/controller/llsw/isoal.c fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment sc=0 always carries a 3-byte timeoffset, so its segment-header len must be at least...

CVE-2026-10654

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BTRFCOMMSTATEDISCONNECTING, DISC sent, RTX timer armed and the connect...

CVE-2026-10654 RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BTRFCOMMSTATEDISCONNECTING, DISC sent, RTX timer armed and the connect...

CVE-2026-10654 RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BTRFCOMMSTATEDISCONNECTING, DISC sent, RTX timer armed and the connect...

CVE-2026-9263

The Zephyr Bluetooth controller ISO Adaptation Layer subsys/bluetooth/controller/llsw/isoal.c fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment sc=0 always carries a 3-byte timeoffset, so its segment-header len must be at least...

Linux Distros Unpatched Vulnerability : CVE-2026-10658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btisorecv in subsys/bluetooth/host/iso.c pulled the ISO SDU header 4 bytes or, when the timestamp flag is set, the timestamped SDU header 8 bytes from the inbou...

CVE-2026-10658 Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation

btisorecv in subsys/bluetooth/host/iso.c pulled the ISO SDU header 4 bytes or, when the timestamp flag is set, the timestamped SDU header 8 bytes from the inbound HCI ISO Data buffer via netbufpullmem without first checking buf-len. The upstream hciiso handler enforces buf-len == the...

CVE-2026-10641 Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)

Zephyr's Bluetooth Classic Hands-Free Profile HFP Hands-Free role parser subsys/bluetooth/host/classic/hfphf.c contains an out-of-bounds write. During Service Level Connection setup the HF sends AT+CIND=? and parses the AG's +CIND: response in cindhandle, which assigns a per-entry counter index a...

EUVD-2020-2534

Malware in sbrugna...

EUVD-2022-24389

Malicious code in bioql PyPI...

EUVD-2023-54135

Malicious code in bioql PyPI...

CVE-2023-4264

Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem...

CVE-2024-8798 Bluetooth: classic: avdtp: missing buffer length check

No proper validation of the length of user input in olcpindhandler in zephyr/subsys/bluetooth/services/ots/otsclient.c...

The vulnerability in the /subsys/bluetooth/host/hci_core.c component of the real-time Bluetooth subsystem of the Zephyr operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability in the /subsys/bluetooth/host/hcicore.c component of the real-time Bluetooth subsystem of the Zephyr operating system relates to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2023-4264 Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem

Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem...

CVE-2023-4264 Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem

Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem...

CVE-2022-1041 Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning

In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning...

PT-2022-13613 · Zephyr · Zephyr

Name of the Vulnerable Software and Affected Versions: Zephyr affected versions not specified Description: An out-of-bound write issue can be triggered in the Zephyr bluetooth mesh core stack during provisioning. Recommendations: At the moment, there is no information about a newer version that...

PT-2022-13612 · Zephyr · Zephyr

Name of the Vulnerable Software and Affected Versions: Zephyr affected versions not specified Description: An out-of-bound write issue can be triggered in the Zephyr bluetooth mesh core stack during provisioning. Recommendations: At the moment, there is no information about a newer version that...