# CVE-2026-19570: Zephyr LE Audio Broadcast Sink buffer overflow in BAP metadata

Source: https://junglewise.ai/threats/cve-2026-19570-the-le-audio-broadcast-sink-in-subsys-bluetooth-audio-bap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19570 · Severity: high · CVSS 8.8 · Published 2026-10-09

Zephyr's LE Audio Bluetooth implementation contains a buffer overflow in its broadcast audio receiver when processing incoming audio announcements. An attacker within radio range can send a malicious broadcast announcement to cause memory corruption and potentially execute code on the device, without requiring any user interaction, pairing, or connection setup.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19570 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19570 being exploited in the wild.

**How severe is CVE-2026-19570?** High severity, with a CVSS score of 8.8, published 9 October 2026.

**Which products and versions are affected?** Zephyr RTOS versions prior to fix.

**Is there a fix for CVE-2026-19570?** No fixed version is recorded yet. Disable LE Audio Broadcast Sink functionality (CONFIG_BT_BAP_BROADCAST_SINK) if not required, or restrict periodic advertising synchronization to trusted sources only.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19570 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-19570?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable LE Audio Broadcast Sink functionality (CONFIG_BT_BAP_BROADCAST_SINK) if not required, or restrict periodic advertising synchronization to trusted sources only.</anigation>
</invoke>

## Technical details

The vulnerability exists in subsys/bluetooth/audio/bap_broadcast_sink.c where subgroup metadata from a Basic Audio Announcement (BASE) is copied into fixed static buffers without bounds checking. The destination array mod_src_param.subgroups is sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS (default 1), and metadata is copied using memcpy() without validating against CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator permits up to ~24 subgroups and ~240-octet metadata, allowing up to 236 bytes of overflow. This is reachable via the periodic advertising receive callback from any broadcast sink once synchronized, with no authentication required.

## Affected products

- Zephyr Zephyr RTOS versions prior to fix

## Timeline

- 2026-10-09: disclosed

## Related threats

- [Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys)
- [Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread)
- [Zephyr HTTP/2 server NULL pointer dereference in stream binding](https://junglewise.ai/threats/cve-2026-87045-the-http-2-server-in-subsys-net-lib-http-http-server-http2-c)
- [Zephyr RTIO submission-queue verifier memory access bypass](https://junglewise.ai/threats/cve-2026-87041-the-rtio-submission-queue-verifier-rtio-vrfy-sqe-in-subsys-rtio)
- [Zephyr i3c_transfer TOCTOU privilege escalation](https://junglewise.ai/threats/cve-2026-87038-the-user-mode-verification-handler-for-the-i3c-transfer-system)