Is CVE-2026-19570 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19570 being exploited in the wild.

How severe is CVE-2026-19570?

High severity, with a CVSS score of 8.8, published 9 October 2026.

Which products and versions are affected?

Zephyr RTOS versions prior to fix.

How is CVE-2026-19570 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-19570?

Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19570: Zephyr LE Audio Broadcast Sink buffer overflow in BAP metadata

CVE-2026-19570 · Severity: high · CVSS 8.8 · Published 2026-10-09

Zephyr's LE Audio Bluetooth implementation contains a buffer overflow in its broadcast audio receiver when processing incoming audio announcements. An attacker within radio range can send a malicious broadcast announcement to cause memory corruption and potentially execute code on the device, without requiring any user interaction, pairing, or connection setup.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-19570 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19570 being exploited in the wild.
How severe is CVE-2026-19570?: High severity, with a CVSS score of 8.8, published 9 October 2026.
Which products and versions are affected?: Zephyr RTOS versions prior to fix.
Is there a fix for CVE-2026-19570?: No fixed version is recorded yet. Disable LE Audio Broadcast Sink functionality (CONFIG_BT_BAP_BROADCAST_SINK) if not required, or restrict periodic advertising synchronization to trusted sources only.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19570 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-19570?: Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable LE Audio Broadcast Sink functionality (CONFIG_BT_BAP_BROADCAST_SINK) if not required, or restrict periodic advertising synchronization to trusted sources only.</anigation> </invoke>

Technical details

The vulnerability exists in subsys/bluetooth/audio/bap_broadcast_sink.c where subgroup metadata from a Basic Audio Announcement (BASE) is copied into fixed static buffers without bounds checking. The destination array mod_src_param.subgroups is sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS (default 1), and metadata is copied using memcpy() without validating against CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator permits up to ~24 subgroups and ~240-octet metadata, allowing up to 236 bytes of overflow. This is reachable via the periodic advertising receive callback from any broadcast sink once synchronized, with no authentication required.

Affected products

Zephyr Zephyr RTOS versions prior to fix

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.