CVE-2026-5068

HighCVSS 7.6

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

In the Bluetooth host stack, during L2CAP LE CoC SDU reassembly, a remote unauthenticated BLE peer can trigger a 2-byte out-of-bounds write. This occurs when segmentation is enabled and the chosen RX pool has user_data_size smaller than 2 bytes, causing the segmentation counter to be written out of bounds in l2cap_chan_le_recv_seg.

Risk Assessment

The attack can cause an AddressSanitizer abort or, without ASan, heap corruption and fatal error, leading to denial of service or potential code execution.

Recommendation

Update the Bluetooth host stack to a version that includes a fix for this issue, ensuring proper size checking before writing the segmentation counter.

Other vulnerabilities in Zephyr Bluetooth Host

CVE-2026-12236Medium
A vulnerability in the parse_read_std_char_desc() function in the Bluetooth host subsystem (subsys/bluetooth/host/gatt.c) allows a remote, unauthenticated device to hang the Bluetooth processing thread by sending an ATT response with a zero entry length (rsp->len = 0). The parsing loop does not validate the minimum value of rsp->len, leading to an infinite loop (CWE-835) and failure to terminate descriptor discovery.

Original NVD description (English source)

A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2 bytes, the segmentation counter stored in the net_buf user_data area is written out of bounds in l2cap_chan_le_recv_seg (subsys/bluetooth/host/l2cap.c). The observed effects are an AddressSanitizer abort and, without ASan, heap corruption / fatal error.