CVE-2026-19570

The LE Audio Broadcast Sink in the Bluetooth subsystem is vulnerable to an out-of-bounds write because it copies subgroup metadata from a received Basic Audio Announcement (BASE) into the mod_src_param structure without proper bounds checking. Specifically, the base_subgroup_meta_cb() function fa...