# CVE-2026-90832: Zephyr Bluetooth HCI out-of-bounds read in periodic advertising

Source: https://junglewise.ai/threats/cve-2026-90832-bt-hci-le-per-adv-report-common-in-subsys-bluetooth-host-scan-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-90832 · Severity: medium · CVSS 4.3 · Published 2026-11-10

Zephyr's Bluetooth stack contains a flaw in how it processes periodic advertising reports from the wireless controller. A malicious or compromised controller can send a specially crafted report that tricks the host into reading memory beyond the event's actual data, causing information disclosure. Applications using Bluetooth LE audio broadcasts or similar features that rely on periodic advertising could leak sensitive data from adjacent memory regions.

Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-90832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90832 being exploited in the wild.

**How severe is CVE-2026-90832?** Medium severity, with a CVSS score of 4.3, published 10 November 2026.

**Which products and versions are affected?** Zephyr Bluetooth stack Versions with CONFIG_BT_PER_ADV_SYNC enabled and CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0.

**Is there a fix for CVE-2026-90832?** No fixed version is recorded yet. Disable CONFIG_BT_PER_ADV_SYNC or ensure CONFIG_BT_PER_ADV_SYNC_BUF_SIZE is set to 0 unless periodic advertising sync with fragmentation reassembly is required. When enabled, use secure HCI controller links and restrict access to prevent injection of malicious HCI reports. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90832 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-90832?** Check whether you run Zephyr Bluetooth stack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable CONFIG_BT_PER_ADV_SYNC or ensure CONFIG_BT_PER_ADV_SYNC_BUF_SIZE is set to 0 unless periodic advertising sync with fragmentation reassembly is required. When enabled, use secure HCI controller links and restrict access to prevent injection of malicious HCI reports.

## Technical details

The bt_hci_le_per_adv_report_common() function in subsys/bluetooth/host/scan.c validates the tailroom of the reassembly buffer but fails to verify that the event payload actually contains the number of bytes claimed in the Data_Length field. An attacker with control over the HCI controller link can send a report with an inflated length value, causing the host to read up to 255 bytes past the end of the actual event data from the HCI RX pool. The out-of-bounds read is copied into the reassembly buffer and delivered to application callbacks, disclosing stale HCI event data without causing memory corruption.

## Affected products

- Zephyr Bluetooth stack Versions with CONFIG_BT_PER_ADV_SYNC enabled and CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0

## Timeline

- 2026-11-10: disclosed

## Related threats

- [Zephyr Bluetooth GATT client buffer overflow on oversized notifications](https://junglewise.ai/threats/cve-2026-85034-the-bluetooth-host-s-gatt-client-passed-the-value-of-a-received)