CVE-2026-10658 Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation

btisorecv in subsys/bluetooth/host/iso.c pulled the ISO SDU header 4 bytes or, when the timestamp flag is set, the timestamped SDU header 8 bytes from the inbound HCI ISO Data buffer via netbufpullmem without first checking buf-len. The upstream hciiso handler enforces buf-len == the...

EUVD-2023-33744

Malicious code in bioql PyPI...

CVE-2023-2234

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host...

CVE-2023-2234

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host...

Design/Logic Flaw

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host...

CVE-2023-2234 BT HCI host union variant confusion

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host...

CVE-2023-2234 BT HCI host union variant confusion

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host...

CVE-2023-2234 BT HCI host union variant confusion

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host...

CVE-2023-2234

The CVE-2023-2234 entry concerns Zephyr RTOS and a Bluetooth HCI host vulnerability described as “union variant confusion” that can let a malicious Bluetooth controller execute arbitrary code on the Zephyr host. Affected component is the Bluetooth HCI host handling union variant selection; the ro...