Description
The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a single file-static net_buf_simple (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512 bytes) shared by all connection instances, while the BUSY flag, long-read handle, and reset/offset state were per-connection.

When the device acts as a Broadcast Assistant connected to multiple Scan Delegator peripherals, notification and long-read callbacks from different connections interleave on the shared buffer: the append in notify_handler (net_buf_simple_add_mem at the not-busy branch) performs no tailroom check, so receive-state notifications from two or more delegators accumulate on the same 512-byte buffer and, with a sufficiently large configured ATT MTU (BT_L2CAP_TX_MTU up to 2000) and two-to-three concurrent connections, write past the buffer into adjacent .bss (net_buf_simple_add only asserts in debug builds).

Even below the overflow threshold, one connection's net_buf_simple_reset zeroes the shared length while another connection's reassembly and GATT read offset are in flight, mixing one peer's data into another's parse. A malicious or compromised Scan Delegator (or two colluding peers) over BLE can trigger this, causing out-of-bounds writes (memory corruption / denial of service) and cross-connection data corruption.

The fix moves the buffer into the per-connection instance struct so each connection reassembles into its own buffer. Affects Zephyr releases shipping the Broadcast Assistant with the shared buffer, including v4.4.0 and earlier.
Published: 2026-07-11
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A shared reassembly buffer in the Bluetooth BAP Broadcast Assistant GATT client causes a classic buffer overflow (CWE‑787). When multiple Scan Delegator peripherals send notifications or long‑read data concurrently, the shared 512‑byte buffer is written beyond its tailroom. The overflow corrupts adjacent memory space in the .bss section, potentially causing a denial of service or mixing data from one peripheral into another’s processing. The flaw also allows an attacker to trigger out‑of‑bounds writes that can lead to broader memory corruption on the device.

Affected Systems

Zephyr OS releases up to and including version 4.4.0 that ship the Broadcast Assistant implementation. Any device functioning as a Broadcast Assistant GATT client in these releases and accepting connections from more than one Scan Delegator is vulnerable.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate risk, and the EPSS score of less than 1 % suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a BLE environment where the device acts as a Broadcast Assistant connected to multiple Scan Delegator peripherals. By configuring a sufficiently large ATT MTU (up to 2000 bytes) and maintaining concurrent connections, an attacker can provoke the overflow. The attack vector is inferred to be local over BLE and does not require elevated privileges on the victim.

Generated by OpenCVE AI on August 1, 2026 at 11:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a release newer than v4.4.0, which incorporates the per‑connection buffer fix.
  • If an upgrade is not immediately feasible, disable or remove the Broadcast Assistant component, or restrict its use to a single connection to avoid the shared buffer condition.
  • Where possible, configure the Bluetooth ATT MTU to its minimum value (23 bytes) and limit the number of simultaneous Scan Delegator connections to below the threshold that could trigger an overflow.

Generated by OpenCVE AI on August 1, 2026 at 11:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 11 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Sat, 11 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Description The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broadcast Receive State data into a single file-static net_buf_simple (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512 bytes) shared by all connection instances, while the BUSY flag, long-read handle, and reset/offset state were per-connection. When the device acts as a Broadcast Assistant connected to multiple Scan Delegator peripherals, notification and long-read callbacks from different connections interleave on the shared buffer: the append in notify_handler (net_buf_simple_add_mem at the not-busy branch) performs no tailroom check, so receive-state notifications from two or more delegators accumulate on the same 512-byte buffer and, with a sufficiently large configured ATT MTU (BT_L2CAP_TX_MTU up to 2000) and two-to-three concurrent connections, write past the buffer into adjacent .bss (net_buf_simple_add only asserts in debug builds). Even below the overflow threshold, one connection's net_buf_simple_reset zeroes the shared length while another connection's reassembly and GATT read offset are in flight, mixing one peer's data into another's parse. A malicious or compromised Scan Delegator (or two colluding peers) over BLE can trigger this, causing out-of-bounds writes (memory corruption / denial of service) and cross-connection data corruption. The fix moves the buffer into the per-connection instance struct so each connection reassembles into its own buffer. Affects Zephyr releases shipping the Broadcast Assistant with the shared buffer, including v4.4.0 and earlier.
Title Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-14T18:38:42.678Z

Reserved: 2026-06-02T15:24:37.969Z

Link: CVE-2026-10660

cve-icon Vulnrichment

Updated: 2026-07-13T15:44:17.104Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T11:30:05Z

Weaknesses