# CVE-2026-85034: Zephyr Bluetooth GATT client buffer overflow on oversized notifications

Source: https://junglewise.ai/threats/cve-2026-85034-the-bluetooth-host-s-gatt-client-passed-the-value-of-a-received  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-85034 · Severity: medium · CVSS 6.7 · Published 2026-11-03

Zephyr's Bluetooth stack allows remote attackers within wireless range to send malicious GATT notifications that exceed the documented 512-octet attribute size limit, causing buffer overflows in applications relying on that limit. An attacker connected to a vulnerable device can trigger out-of-bounds writes, potentially leading to information disclosure, denial of service, or code execution depending on affected memory layouts and build configurations.

Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-85034 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85034 being exploited in the wild.

**How severe is CVE-2026-85034?** Medium severity, with a CVSS score of 6.7, published 3 November 2026.

**Which products and versions are affected?** Zephyr Bluetooth stack versions prior to the fix.

**Is there a fix for CVE-2026-85034?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85034 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-85034?** Check whether you run Zephyr Bluetooth stack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Bluetooth GATT client in Zephyr's subsys/bluetooth/host/att.c and l2cap.c fails to enforce the ATT MTU against received Handle Value Notifications and Indications, allowing values up to CONFIG_BT_BUF_ACL_RX_SIZE instead of the specified 512-octet limit. Applications and in-tree LE Audio clients (bap_unicast_client.c, bap_broadcast_assistant.c) that buffer notifications to 512 octets can experience out-of-bounds writes; the overflow corrupts adjacent net_buf_simple structures, enabling controlled writes via subsequent long-read accumulation. The fix validates notification/indication lengths in call_notify_cb_and_maybe_unsubscribe() before invoking subscriber callbacks.

## Affected products

- Zephyr Bluetooth stack versions prior to the fix

## Timeline

- 2026-11-03: disclosed

## Related threats

- [Zephyr Bluetooth HCI out-of-bounds read in periodic advertising](https://junglewise.ai/threats/cve-2026-90832-bt-hci-le-per-adv-report-common-in-subsys-bluetooth-host-scan-c)