CVE-2026-15894

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

EUVD-2026-94230

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

CVE-2026-15894

The Zephyr RTOS Bluetooth Mesh stack is vulnerable to a stack-based buffer overflow in the On-Demand Private Proxy solicitation handler (subsys/bluetooth/mesh/solicitation.c). The sol_pdu_decrypt() function copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the ...

CVE-2026-5589: Out-of-bounds Write

An integer underflow in btmeshsolrecv in the Bluetooth Mesh solicitation handling subsys/bluetooth/mesh/solicitation.c leads to an out-of-bounds write. When CONFIGBTMESHODPRIVPROXYSRV is enabled, the function parses solicitation PDUs from raw BLE advertising payloads. The AD parsing loop reads an...