Buffer Overflow in Zephyr RTOS Bluetooth BAP Broadcast Assistant

Executive Summary

CVE-2026-10660 is a vulnerability in the Zephyr RTOS Bluetooth Broadcast Assistant (BAP) where a single static buffer (att_buf) is shared across all connection instances to reassemble remote Broadcast Receive State data.

While some state flags and handles are managed per connection, the shared buffer allows notification and long-read callbacks from multiple connections to interleave and append data without checking available space. This can cause buffer overflows or data corruption when multiple Scan Delegator peripherals connect concurrently.

A malicious or compromised Scan Delegator can exploit this by sending crafted data over Bluetooth Low Energy (BLE), leading to out-of-bounds writes, memory corruption, denial of service, and cross-connection data corruption.

The vulnerability affects Zephyr versions from 3.6.0 to 4.4.0 and was fixed by moving the buffer into per-connection instances so each connection uses its own buffer.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption and denial of service on devices running affected Zephyr RTOS versions when acting as a Bluetooth Broadcast Assistant connected to multiple Scan Delegator peripherals.

An attacker controlling one or more Scan Delegators can cause out-of-bounds writes that corrupt memory, potentially crashing the device or causing unpredictable behavior.

Additionally, data from one connection can be mixed into another, leading to cross-connection data corruption which may compromise data integrity and confidentiality.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from the Bluetooth Broadcast Assistant (BAP) in Zephyr RTOS when connected to multiple Scan Delegator peripherals, causing memory corruption due to a shared buffer overflow. Detection involves monitoring Bluetooth Low Energy (BLE) connections for abnormal behavior such as unexpected crashes, memory corruption symptoms, or data corruption between connections.

Since the issue is related to the internal buffer management in the Zephyr Bluetooth stack, direct detection commands on the network or system are not explicitly provided in the available resources.

However, to investigate or detect this vulnerability, you might consider monitoring BLE traffic and connection states using tools like 'btmon' (Bluetooth monitor) on Linux systems to observe multiple concurrent Scan Delegator connections and any unusual notifications or long-read operations.

Additionally, debugging or logging within the Zephyr RTOS Bluetooth stack, especially around the Broadcast Assistant GATT client, could help identify buffer overflows or data corruption events.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update the Zephyr RTOS to a version where the vulnerability is fixed. The issue is resolved by moving the shared reassembly buffer into a per-connection instance buffer, preventing cross-connection data corruption.

• Upgrade Zephyr RTOS to version 4.5.0 or later, or apply backported fixes available in versions 4.3, 4.4, and 3.7 branches.
• If upgrading immediately is not possible, limit the number of concurrent Scan Delegator connections to reduce the risk of buffer overflow.
• Avoid using large ATT MTU sizes (close to 2000 bytes) in configurations until the fix is applied.

These steps help prevent exploitation by malicious or compromised Scan Delegators that could trigger out-of-bounds writes and memory corruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability in the Zephyr RTOS Bluetooth Broadcast Assistant allows memory corruption and cross-connection data corruption due to a shared buffer being used for multiple connections. Such data corruption could potentially lead to unauthorized data exposure or denial of service.

While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, the vulnerability's impact on confidentiality and integrity (as indicated by the CVSS score) suggests that if exploited, it could compromise sensitive data handled by devices using the affected software.

Therefore, organizations using affected versions of Zephyr RTOS in environments subject to regulations like GDPR or HIPAA should consider this vulnerability a risk to data protection and system availability, potentially affecting compliance if exploited.

Useful 0 Not Useful 0