The classic Bluetooth BR/EDR L2CAP signaling handlers validate the minimum command size against the total remaining bytes in the received packet instead of the per‑command length declared in the signaling header. An attacker can send a CONF_REQ packet with an undersized header followed by another command so that the length check passes wrongly, causing an unsigned 16‑bit underflow that yields an opt_len close to 0xFFFF. The subsequent option parsing loop has no bounds check and reads far beyond the ACL receive buffer, producing an out‑of‑bounds read of host memory and, when the leaked option bytes encode an MTU or flush‑timeout option, an out‑of‑bounds write. This corrupted memory can lead to a Zephyr host crash, i.e., denial of service. The flaw is a classic out‑of‑bounds memory corruption (CWE‑125).

Zephyr Project’s Zephyr RTOS is affected, including all released versions up to at least v4.4.0 and any later releases that do not incorporate the recent commit that fixes the length validation. The defect is present in code under subsys/bluetooth/host/classic/l2cap_br.c and affects any device running the classic BR/EDR stack. Devices that enable legacy BR/EDR L2CAP signaling are susceptible; those that have disabled or upgraded to the fixed code are not.

The CVSS base score of 7.6 represents a high impact, but the EPSS of less than 1% indicates that, as of this analysis, exploitation is unlikely. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an unauthenticated Bluetooth device within radio range can establish an ACL connection before pairing or encryption and send the malicious L2CAP packet, enabling remote exploitation with no user interaction. Consequently, the risk to systems that enable legacy BR/EDR L2CAP is significant for adversaries with proximity access, though overall threat remains low due to the limited attack surface and low exploitation probability.