# CVE-2026-79982: Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path

Source: https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-79982 · Severity: high · CVSS 8.8 · Published 2026-10-23

Zephyr RTOS's Bluetooth HCI USB transport layer contains a buffer overflow vulnerability in the subsys/usb/device_next/class/bt_hci.c component that processes packets from a wireless Bluetooth controller. An attacker within Bluetooth range can send specially crafted wireless packets (or exploit default initialization traffic) to corrupt memory on the device, potentially leading to arbitrary code execution or denial of service depending on build configuration. Devices without memory protection between subsystems are at highest risk of code execution.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-79982 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79982 being exploited in the wild.

**How severe is CVE-2026-79982?** High severity, with a CVSS score of 8.8, published 23 October 2026.

**Which products and versions are affected?** Zephyr RTOS unspecified.

**Is there a fix for CVE-2026-79982?** Yes: fixed in unspecified. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79982 attacked?** It is attacked from the adjacent network or over the network, in an operating system.

**Am I affected by CVE-2026-79982?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in unspecified

## Technical details

The vulnerability is a heap buffer overflow in bt_hci_tx_sync_in() where controller-to-host HCI packets are copied into a fixed 64-byte buffer pool without length validation. HCI event and ACL buffers are sized by configuration constants that can exceed 64 bytes; even the mandatory Read Supported Commands event is 70 bytes on default builds. An attacker can send oversized ACL fragments or extended advertising reports over the air to trigger the overflow. On production builds with CONFIG_ASSERT=n, memory corruption occurs silently; on debug builds, an assertion failure causes denial of service.

## Affected products

- Zephyr RTOS unspecified

## Timeline

- 2026-10-23: disclosed

## Related threats

- [Zephyr RTOS PECI driver privilege escalation in peci_transfer()](https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy)
- [Zephyr Bluetooth host ATT buffer use-after-free in signed write path](https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does)
- [Zephyr Bluetooth Mesh Access layer delayable message context leak](https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in)
- [Zephyr TCP ISN derivation with all-zero key on entropy failure](https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net)
- [Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption](https://junglewise.ai/threats/cve-2026-19186-ieee802154-decipher-data-frame-in-subsys-net-l2-ieee802154)