Executive brief
A vulnerability exists in the Bluetooth Mesh component of the Zephyr operating system, which is commonly used in embedded and IoT devices. An attacker within Bluetooth range can send a specially crafted wireless signal to trigger a system crash or potentially take control of the device. This issue affects devices configured to support specific Bluetooth Mesh proxy services and does not require the attacker to be paired or previously connected to the target.
Technical details
An integer underflow exists in the `bt_mesh_sol_recv()` function within `subsys/bluetooth/mesh/solicitation.c` when `CONFIG_BT_MESH_OD_PRIV_PROXY_SRV` is enabled. The vulnerability occurs during the parsing of solicitation PDUs from raw BLE advertising payloads. An attacker-controlled length byte (`reported_len`) is used in a subtraction operation (`reported_len - 3`) without a minimum value check. If `reported_len` is less than 3, the result is a negative integer that bypasses length guards and is subsequently cast to a large `size_t` value in `net_buf_simple_pull_mem()`. This causes the buffer data pointer to advance far out of bounds. In builds where assertions are disabled, this leads to out-of-bounds memory access, potentially resulting in arbitrary code execution or a system crash. The attack can be launched via a non-connectable advertisement with a UUID16 AD structure.
Affected products
- Zephyr Project Zephyr OS <=4.3.0
Timeline
- 2026-06-03: other: Embargo date
- 2026-06-04: disclosed: Initial disclosure and NVD publication