CVE-2026-85034: Zephyr Bluetooth GATT client buffer overflow on oversized notifications

CVE-2026-85034 · Severity: medium · CVSS 6.7 · Published 2026-11-03

Zephyr's Bluetooth stack allows remote attackers within wireless range to send malicious GATT notifications that exceed the documented 512-octet attribute size limit, causing buffer overflows in applications relying on that limit. An attacker connected to a vulnerable device can trigger out-of-bounds writes, potentially leading to information disclosure, denial of service, or code execution depending on affected memory layouts and build configurations.

Vendors: Zephyr.

Quick answers

Is CVE-2026-85034 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85034 being exploited in the wild.
How severe is CVE-2026-85034?
Medium severity, with a CVSS score of 6.7, published 3 November 2026.
Which products and versions are affected?
Zephyr Bluetooth stack versions prior to the fix.
Is there a fix for CVE-2026-85034?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85034 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-85034?
Check whether you run Zephyr Bluetooth stack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Bluetooth GATT client in Zephyr's subsys/bluetooth/host/att.c and l2cap.c fails to enforce the ATT MTU against received Handle Value Notifications and Indications, allowing values up to CONFIG_BT_BUF_ACL_RX_SIZE instead of the specified 512-octet limit. Applications and in-tree LE Audio clients (bap_unicast_client.c, bap_broadcast_assistant.c) that buffer notifications to 512 octets can experience out-of-bounds writes; the overflow corrupts adjacent net_buf_simple structures, enabling controlled writes via subsequent long-read accumulation. The fix validates notification/indication lengths in call_notify_cb_and_maybe_unsubscribe() before invoking subscriber callbacks.

Affected products

  • Zephyr Bluetooth stack versions prior to the fix

Timeline

  • 2026-11-03: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.