Zephyr’s Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer‑supplied ASE state notifications. This is a CWE‑476: NULL pointer dereference vulnerability. In the unicast_client_ep_qos_state function, the handler writes attacker‑controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) directly through the stream->qos pointer guarded only by a stream != NULL check. The stream->qos pointer is NULL for any stream that has been codec‑configured via bt_bap_stream_config() but not yet added to a unicast group, and a malicious or buggy remote ASCS server can trigger the QoS Configured notification while the local endpoint is still in the Codec Configured state. This causes a NULL dereference, a crash (denial of service), and the data written originates from the remote client. The defect appeared in Zephyr v4.3.0 and v4.4.0 and earlier. The fix re‑points all BAP QoS storage to the always‑valid embedded ep->qos struct, eliminating the NULL dereference.

Zephyr OS component. The vulnerability exists in Zephyr releases 4.3.0, 4.4.0, and earlier versions containing the original unicast_client_ep_qos_state routine.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote BLE GATT notification sent by a malicious or buggy ASCS server to a device acting as a BAP unicast client. No privileged access is required; triggering the crash only needs connectivity to the vulnerable device.