Executive brief
Zephyr is an open-source operating system designed for resource-constrained Internet of Things (IoT) devices. A flaw in its Bluetooth software could allow a nearby attacker to cause a device to crash or behave unpredictably by sending a specially crafted Bluetooth response. This could lead to a loss of service or potentially allow the attacker to gain unauthorized control over the device's operations.
Technical details
A use-after-free (UAF) vulnerability exists in the Zephyr Bluetooth GATT client CCC-write response handler, gatt_write_ccc_rsp(), located in subsys/bluetooth/host/gatt.c. The handler incorrectly invokes an application's subscribe() callback after it has already triggered a notify() callback with NULL data, which is the documented signal that the subscription structure can be freed or reused. An attacker within Bluetooth range (adjacent) can trigger this condition by acting as a GATT server and responding to a subscription request with an ATT Error Response. This results in an indirect call through a potentially freed function pointer, leading to memory corruption, system crashes, or arbitrary code execution. The issue is fixed in Zephyr version 4.5.0 and backported to several LTS branches.
Affected products
- Zephyr Project Zephyr RTOS >= 2.4.0, < 4.5.0
Timeline
- 2026-07-31: disclosed
- 2026-07-31: advisory
- 2026-07-31: patched