CVE-2026-5589

The CVE affects Zephyr’s Bluetooth Mesh subsystem, specifically bt_mesh_sol_recv() in subsys/bluetooth/mesh/solicitation.c. When CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled, the AD parsing loop reads a length byte (reported_len) and computes reported_len - 3 without ensuring reported_len >= 3....