CVE-2026-5589

The Zephyr RTOS Bluetooth Mesh subsystem is vulnerable to an out-of-bounds write caused by an integer underflow in the bt_mesh_sol_recv() function (subsys/bluetooth/mesh/solicitation.c). When CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled, the system parses solicitation PDUs from raw BLE advertising...