Executive brief
Zephyr RTOS is an open-source operating system designed for resource-constrained devices. A vulnerability in its Bluetooth Classic implementation allows a malicious or compromised device (such as a spoofed phone or headset) to crash the system or corrupt its memory during the initial connection process. This could lead to a total loss of Bluetooth functionality or a device reboot without any user interaction.
Technical details
An out-of-bounds write exists in `subsys/bluetooth/host/classic/hfp_hf.c` within the `cind_handle_values()` function. During the Service Level Connection (SLC) setup, the Hands-Free (HF) role parses the Audio Gateway's (AG) `+CIND:` response. The parser fails to validate that the number of indicator entries provided by the AG stays within the 20-element `ind_table` array in `struct bt_hfp_hf`. An attacker can provide more than 20 entries to increment the index beyond array bounds, leading to the corruption of adjacent struct fields such as feature masks, SDP state, and atomic bookkeeping. This can be triggered via a single malformed AT response over Bluetooth (Adjacent vector) with no prior authentication or user interaction. The issue is fixed in versions 3.7.3, 4.3.1, 4.4.2, and 4.5.0.
Affected products
- Zephyr Project Zephyr RTOS >= 1.7.0, < 4.5.0
Timeline
- 2026-06-17: advisory: GHSA-wx5j-q6f2-59p3 published
- 2026-06-17: disclosed: CVE-2026-10641 published