Is CVE-2026-85033 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85033 being exploited in the wild.

How severe is CVE-2026-85033?

Medium severity, with a CVSS score of 4.6, published 3 November 2026.

Which products and versions are affected?

Zephyr OS <unknown; advisory does not specify.

How is CVE-2026-85033 attacked?

It is attacked from the adjacent network, in an operating system.

Am I affected by CVE-2026-85033?

Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85033: Zephyr AVRCP Target vendor response buffer leak on disconnection

Q: Which products and versions are affected?

Zephyr OS <unknown; advisory does not specify.

Q: Is there a fix for CVE-2026-85033?

Yes: fixed in Not specified in advisory. Until then: Restrict AVRCP Target role to trusted paired devices only, or disable AVRCP Target functionality if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-85033 attacked?

It is attacked from the adjacent network, in an operating system.

Q: Am I affected by CVE-2026-85033?

Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85033 · Severity: medium · CVSS 4.6 · Published 2026-11-03

Zephyr's Bluetooth AVRCP Target implementation, which handles audio remote control commands from Bluetooth devices, fails to clean up vendor-dependent response buffers when a paired connection is dropped during a fragmented response. A paired attacker can trigger this repeatedly to permanently disable AVRCP functionality for all future connections to that device without triggering any timeout or alerting the user; recovery requires a reboot. Additionally, each attack cycle leaks response buffers from a limited pool.

Technologies: Zephyr OS. Vendors: Zephyr.

Quick answers

Is CVE-2026-85033 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85033 being exploited in the wild.
How severe is CVE-2026-85033?: Medium severity, with a CVSS score of 4.6, published 3 November 2026.
Which products and versions are affected?: Zephyr OS <unknown; advisory does not specify.
Is there a fix for CVE-2026-85033?: Yes: fixed in Not specified in advisory. Until then: Restrict AVRCP Target role to trusted paired devices only, or disable AVRCP Target functionality if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85033 attacked?: It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-85033?: Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Not specified in advisory

Restrict AVRCP Target role to trusted paired devices only, or disable AVRCP Target functionality if not required.

Technical details

The vulnerability exists in subsys/bluetooth/host/classic/avrcp.c where the AVRCP disconnect handler (avrcp_disconnected) fails to cancel pending TX work and release queued response buffers in the vd_rsp_tx_pending list. When a fragmented vendor-dependent response (START fragment) is initiated and the ACL link drops before completion, the buffer remains queued with TX_ONGOING still set. On the next connection using the same index, this stale buffer blocks all subsequent vendor responses. Exploitation requires an encrypted BR/EDR link (BT_SECURITY_L2) with a paired peer within radio range; no memory corruption or use-after-free occurs.

Affected products

Zephyr Zephyr OS <unknown; advisory does not specify

Timeline

2026-11-03: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.