Is CVE-2026-5068 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5068 being exploited in the wild.

How severe is CVE-2026-5068?

High severity, with a CVSS score of 7.6, published 9 June 2026.

Which products and versions are affected?

Zephyr Project Zephyr OS <= 4.4.0.

Is there a fix for CVE-2026-5068?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5068 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-5068?

Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5068: Zephyr OS out-of-bounds write in Bluetooth L2CAP LE CoC

Q: Is there a fix for CVE-2026-5068?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-5068 attacked?

It is attacked from the adjacent network, in an operating system.

Q: Am I affected by CVE-2026-5068?

Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5068 · Severity: high · CVSS 7.6 · Published 2026-06-09

A vulnerability exists in the Bluetooth software of the Zephyr operating system, which is commonly used in embedded and IoT devices. A nearby attacker can send specially crafted Bluetooth signals to cause the device to crash or malfunction. This could lead to a complete service outage or allow an attacker to corrupt the device's memory, potentially impacting its reliability and security.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-5068 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5068 being exploited in the wild.
How severe is CVE-2026-5068?: High severity, with a CVSS score of 7.6, published 9 June 2026.
Which products and versions are affected?: Zephyr Project Zephyr OS <= 4.4.0.
Is there a fix for CVE-2026-5068?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5068 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-5068?: Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) write vulnerability exists in the Zephyr Bluetooth host within the L2CAP LE Credit Based Flow Control (CoC) SDU reassembly logic. The flaw is located in `l2cap_chan_le_recv_seg` in `subsys/bluetooth/host/l2cap.c`. When an application enables segmentation via `chan_ops.alloc_buf` and the RX pool's `user_data_size` is configured to be smaller than 2 bytes, the segmentation counter is written past the allocated buffer. An unauthenticated attacker within Bluetooth range (adjacent) can exploit this to cause heap corruption, a fatal error, or an AddressSanitizer abort. Patches have been developed for the main branch and version 4.3.

Affected products

Zephyr Project Zephyr OS <= 4.4.0

Timeline

2026-05-21: other: Embargo date
2026-06-09: disclosed: Initial disclosure and NVD publication

References

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qrcq-hxwj-mqxm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.