CVE-2026-77685: Zephyr RFCOMM multiplexer buffer overflow and information disclosure

CVE-2026-77685 · Severity: high · CVSS 8.3 · Published 2026-11-10

Zephyr's Bluetooth RFCOMM implementation contains a buffer overflow and memory disclosure vulnerability in the multiplexer control channel. An unpaired Bluetooth device within radio range can send a specially crafted packet to trigger an out-of-bounds read and write, potentially crashing the Bluetooth stack and leaking sensitive memory contents. This affects embedded devices running Zephyr with Bluetooth Classic and RFCOMM profiles enabled, such as those using SPP, HFP, HSP, or GOEP.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-77685 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77685 being exploited in the wild.
How severe is CVE-2026-77685?
High severity, with a CVSS score of 8.3, published 10 November 2026.
Which products and versions are affected?
Zephyr RTOS Prior to fixes in commit 0040ef781e1d and 214530895dd3; v4.3.2 contains fix 1 only and remains vulnerable to residual write overrun.
Is there a fix for CVE-2026-77685?
Yes: fixed in Commits 0040ef781e1d (#115768) and 214530895dd3 (#118293); both fixes required to fully resolve the vulnerability. v4.3.2 contains only the first fix and remains partially vulnerable.. Until then: Disable CONFIG_BT_RFCOMM or CONFIG_BT_CLASSIC if Bluetooth Classic and RFCOMM profiles are not required. If RFCOMM must be enabled, ensure both commits 0040ef781e1d and 214530895dd3 are applied; note that v4.3.x branch will only receive the first fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77685 attacked?
It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-77685?
Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Commits 0040ef781e1d (#115768) and 214530895dd3 (#118293); both fixes required to fully resolve the vulnerability. v4.3.2 contains only the first fix and remains partially vulnerable.

Disable CONFIG_BT_RFCOMM or CONFIG_BT_CLASSIC if Bluetooth Classic and RFCOMM profiles are not required. If RFCOMM must be enabled, ensure both commits 0040ef781e1d and 214530895dd3 are applied; note that v4.3.x branch will only receive the first fix.

Technical details

The RFCOMM handler incorrectly computes echo length for BT_RFCOMM_TEST commands, causing integer underflow when processing malformed but FCS-valid frames on DLCI 0. This leads to a 255-byte out-of-bounds read from the ACL receive buffer and an out-of-bounds write to the L2CAP transmit buffer (overrunning by ~8 bytes). The vulnerability is reachable on the multiplexer control channel (PSM 3) before any DLC exists and without authentication, requiring only an unpaired device within Bluetooth range to send a five-byte RFCOMM frame.

Affected products

  • Zephyr Zephyr RTOS Prior to fixes in commit 0040ef781e1d and 214530895dd3; v4.3.2 contains fix 1 only and remains vulnerable to residual write overrun

Timeline

  • 2026-11-10: disclosed
  • 2026-11-10: patched: Fix 1 (commit 0040ef781e1d, #115768)
  • 2026-11-10: patched: Fix 2 (commit 214530895dd3, #118293) required for complete remediation

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.