EUVD-2026-109972

The Object Transfer Service server builds its Object Action Control Point OACP response indication in oacpindsend subsys/bluetooth/services/ots/otsoacp.c. Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BTGATTOTSOACPPROCCHECKSUMCALC, regardless o...

CVE-2026-81038

The Bluetooth Object Transfer Service (OTS) server is vulnerable to an uninitialized stack memory disclosure or denial of service via the Object Action Control Point (OACP). The flaw exists in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c), where the net_buf_simple_pull_le32()function...

CVE-2026-81038 Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses

The Object Transfer Service server builds its Object Action Control Point OACP response indication in oacpindsend subsys/bluetooth/services/ots/otsoacp.c. Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BTGATTOTSOACPPROCCHECKSUMCALC, regardless o...

CVE-2026-81038 Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses

The Object Transfer Service server builds its Object Action Control Point OACP response indication in oacpindsend subsys/bluetooth/services/ots/otsoacp.c. Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BTGATTOTSOACPPROCCHECKSUMCALC, regardless o...