CVE-2026-5706
HighCVSS 8.9Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network.
Risk Assessment
Remote code execution in mesh devices could allow an attacker to take control of the device and the network. This may lead to integrity and confidentiality breaches.
Recommendation
Upgrade the Bluetooth Mesh SDK to the latest patched version. Restrict the ability to join new devices to the network.
Original NVD description (English source)
In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may be impacted.