Quick answers
- Is CVE-2026-10658 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-10658 being exploited in the wild.
- How severe is CVE-2026-10658?
- High severity, with a CVSS score of 7.1, published 23 June 2026.
- Which products and versions are affected?
- Zephyr Project Zephyr OS <= 4.4.0.
- Is there a fix for CVE-2026-10658?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-10658 attacked?
- It is attacked from the adjacent network, in an operating system.
- Am I affected by CVE-2026-10658?
- Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the Zephyr Bluetooth Host ISO receive path within `subsys/bluetooth/host/iso.c`. Specifically, the `bt_iso_recv()` function processes PB=START/SINGLE fragments by pulling SDU headers (4 or 8 bytes) using `net_buf_pull_mem()` without verifying that the buffer contains sufficient data. While the outer `hci_iso()` function validates payload consistency, it does not enforce a minimum size for inner SDU headers. An attacker with the ability to influence HCI data (e.g., via a compromised controller or adjacent Bluetooth traffic) can send a packet with a minimal payload (e.g., 1 byte) to trigger a kernel assertion in builds with asserts enabled, or an out-of-bounds read in non-assert builds. The issue affects configurations with `CONFIG_BT_ISO_RX` enabled.
Affected products
- Zephyr Project Zephyr OS <= 4.4.0
Timeline
- 2026-06-21: other: Embargo date
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date