CVE-2026-10660: Zephyr OS Bluetooth BAP Broadcast Assistant out-of-bounds write

CVE-2026-10660 · Severity: medium · CVSS 6.4 · Published 2026-07-11

A vulnerability exists in the Zephyr operating system's Bluetooth audio component, which is used to manage wireless audio broadcasts. When the system is connected to multiple Bluetooth devices simultaneously, it incorrectly uses a single shared memory area to process data from all of them. A malicious or compromised Bluetooth device nearby could exploit this to corrupt the system's memory, potentially leading to a device crash or the mixing of private data between different connected users.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-10660 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10660 being exploited in the wild.
How severe is CVE-2026-10660?
Medium severity, with a CVSS score of 6.4, published 11 July 2026.
Which products and versions are affected?
Zephyr Project Zephyr OS >= 3.6.0, <= 4.4.0.
Is there a fix for CVE-2026-10660?
A patch was published on 2026-05-12: Fix merged to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10660 attacked?
It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-10660?
Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Bluetooth BAP Broadcast Assistant GATT client in `subsys/bluetooth/audio/bap_broadcast_assistant.c` utilizes a single file-static `net_buf_simple` (`att_buf`) for reassembling Broadcast Receive State data. While connection state flags are per-instance, the 512-byte buffer is shared. When connected to multiple Scan Delegators, interleaved notification and long-read callbacks can cause data from different connections to accumulate in the same buffer. Because `notify_handler` lacks a tailroom check, concurrent connections can trigger an out-of-bounds write into adjacent `.bss` memory or cause cross-connection data corruption when one connection resets the shared buffer while another's reassembly is in progress. This is exploitable by an adjacent attacker via a malicious Scan Delegator. The fix moves the buffer into the per-connection instance structure.

Affected products

  • Zephyr Project Zephyr OS >= 3.6.0, <= 4.4.0

Timeline

  • 2026-04-20: other: Fix authored
  • 2026-05-12: patched: Fix merged to main branch
  • 2026-07-11: disclosed: Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.