Executive brief
A vulnerability in the Zephyr operating system's Bluetooth component allows a nearby attacker to access sensitive information from the device's memory. By sending specially crafted Bluetooth data packets, an attacker can trick the system into reading and transmitting internal memory contents that should remain private. This could lead to the exposure of sensitive data or cause the device to become unstable or crash.
Technical details
An out-of-bounds read exists in `subsys/bluetooth/controller/ll_sw/isoal.c` due to insufficient validation of the length field in framed ISO PDU start segments. When a segment has a 'start' code (sc=0), the Bluetooth specification requires a 3-byte time offset, but `isoal_check_seg_header()` fails to verify that the segment length is at least 3 bytes. This leads to an integer underflow in `isoal_rx_framed_consume()` when calculating the remaining length, resulting in an oversized length (up to 255 bytes) being passed to `isoal_rx_append_to_sdu()`. An adjacent attacker can exploit this over-the-air via CIS or BIS data paths to read adjacent controller memory, which is then delivered to the host via HCI ISO data packets. The issue is patched in Zephyr v4.5.0 and backported to several LTS branches.
Affected products
- Zephyr Project Zephyr RTOS >= 3.0.0, < 4.5.0
Timeline
- 2026-06-28: other: Embargo date
- 2026-06-30: advisory: GHSA-6gvp-pmh8-fjh2 published
- 2026-06-30: patched: Fixes merged into main and stable branches