A malformed Bluetooth Classic Service Discovery Protocol attribute can trigger an assertion in Zephyr’s SDP parser. The parser consumes a 3‑byte header unconditionally and expects a fourth byte for the value type, so a truncated 3‑byte attribute reaches a net_buf_simple_pull() call with insufficient data. If assertions are enabled, this leads to a kernel panic, denying service to the device. If assertions are disabled, the parser may read past the buffer’s end, resulting in undefined behaviour and a potential data leak. This is a classic buffer handling flaw that can be exploited to crash the target or disclose memory contents.

This affects Zephyr, the real‑time operating system developed by zephyrproject‑rtos. Any Zephyr build that includes Bluetooth Classic functionality and does not apply the upstream patch is susceptible. The specific vulnerable code is the SDP parser in subsys/bluetooth/host/classic/sdp.c, triggered via any SDP packet that contains a malformed attribute string sent to the device.

The issue has a CVSS score of 7.1, indicating moderate risk. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, and the KEV catalog does not list it as known exploited. The vulnerability is remote in that it requires an attacker to send a specially crafted SDP attribute over Bluetooth Classic, which a nearby device can do without authentication. Based on the description, it is inferred that the attacker must establish a Bluetooth connection and transmit the truncated attribute; successful exploitation will cause either a crash or an out‑of‑bounds read.