Description
The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base_subgroup_meta_cb() the destination element was selected as mod_src_param.subgroups[mod_src_param.num_subgroups] with no test against ARRAY_SIZE(mod_src_param.subgroups) (sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, default 1), and the metadata was copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to ~24 subgroups and metadata LTVs of ~240 octets.

The defect is reached from the periodic advertising receive callback: pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). Every broadcast sink registers a scan-delegator receive state at creation (bt_bap_broadcast_sink_create() calls broadcast_sink_add_src()), and CONFIG_BT_BAP_BROADCAST_SINK depends on CONFIG_BT_BAP_SCAN_DELEGATOR, so the path is active in every broadcast-sink build once the device is periodic-advertising-synced. An attacker in radio range who operates a broadcast source the device syncs to — or who impersonates the advertiser address and SID of one already in use, periodic advertising data being unauthenticated — can change the BASE at will; each new BASE is re-parsed.

A crafted BASE therefore writes attacker-chosen bytes past the end of a fixed static object in .bss: up to roughly 236 bytes for an oversized metadata LTV, plus whole struct bt_bap_bass_subgroup records for each subgroup beyond CONFIG_BT_BAP_BASS_MAX_SUBGROUPS. This is memory corruption of adjacent Bluetooth-audio state reachable with no pairing, bonding or GATT connection, with a potential for remote code execution in the Bluetooth RX thread; in addition, the unvalidated metadata_len is forwarded to bt_bap_scan_delegator_mod_src(), which neither clamps it nor rejects it, leading to a further copy into the receive state and to out-of-bounds memory being disclosed in the BASS receive-state notification sent to a connected Broadcast Assistant.

The fix rejects a BASE carrying more subgroups than the receive state can hold (discarding the update entirely) and omits metadata that does not fit rather than copying it, and additionally honours the previously-ignored error return of the subgroup decode pass.
Published: 2026-10-09
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Out‑of‑bounds write that can lead to remote code execution and memory disclosure
Action: Immediate Patch
AI Analysis

Impact

The LE Audio Broadcast Sink subsystem contains an out‑of‑bounds write when copying subgroup metadata from a received Basic Audio Announcement into a fixed static BASS receive state structure. The code selects the destination element based on the number of subgroups reported in the BASE without verifying it against the configured array size, and copies raw metadata of the on‑air length into a small buffer. An attacker can craft a BASE that reports many subgroups or contains oversized metadata, causing memory corruption of adjacent Bluetooth‑audio state. This corruption can trigger code execution in the Bluetooth RX thread and expose internal state through a BASS receive‑state notification forwarded to connected Broadcast Assistants.

Affected Systems

The vulnerability affects the Zephyr RTOS Bluetooth stack, specifically the LE Audio Broadcast Sink implementation in subsys/bluetooth/audio/bap_broadcast_sink.c. Any Zephyr build that enables CONFIG_BT_BAP_BROADCAST_SINK and does not include the post‑commit 5738f61f hotfix is affected. Unsupported or legacy Zephyr releases that still ship this code path are also vulnerable.

Risk and Exploitability

With a CVSS score of 8.8 the vulnerability is classified as High severity. The EPSS score is not available, but the description indicates that the attack can be launched from radio range without pairing, bonding, or a GATT connection. The attacker needs only to send a malformed periodic advertising packet from a source that the device synchronizes to, which is achievable because periodic advertising data is unauthenticated. The vulnerability is not listed in CISA’s KEV catalog, but the lack of authentication and the high potential impact make it a serious threat. If exploited, an attacker can execute arbitrary code or retrieve sensitive memory from the Bluetooth stack, potentially compromising the entire device.

Generated by OpenCVE AI on October 9, 2026 at 08:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Zephyr patch that bounds checks the subgroup count and metadata length (commit 5738f61f) or upgrade to a release that contains the fix.
  • If a patch cannot be applied immediately, disable the LE Audio Broadcast Sink feature by setting CONFIG_BT_BAP_BROADCAST_SINK=n in the project configuration, or disable periodic advertising reception by setting CONFIG_BT_BAP_SCAN_DELEGATOR=n.
  • Monitor the device for abnormal Bluetooth activity or crash reports that may indicate exploitation attempts, and verify that no unauthenticated broadcast sources are actively announcing to the sink.

Generated by OpenCVE AI on October 9, 2026 at 08:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Fri, 09 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Description The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base_subgroup_meta_cb() the destination element was selected as mod_src_param.subgroups[mod_src_param.num_subgroups] with no test against ARRAY_SIZE(mod_src_param.subgroups) (sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, default 1), and the metadata was copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to ~24 subgroups and metadata LTVs of ~240 octets. The defect is reached from the periodic advertising receive callback: pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). Every broadcast sink registers a scan-delegator receive state at creation (bt_bap_broadcast_sink_create() calls broadcast_sink_add_src()), and CONFIG_BT_BAP_BROADCAST_SINK depends on CONFIG_BT_BAP_SCAN_DELEGATOR, so the path is active in every broadcast-sink build once the device is periodic-advertising-synced. An attacker in radio range who operates a broadcast source the device syncs to — or who impersonates the advertiser address and SID of one already in use, periodic advertising data being unauthenticated — can change the BASE at will; each new BASE is re-parsed. A crafted BASE therefore writes attacker-chosen bytes past the end of a fixed static object in .bss: up to roughly 236 bytes for an oversized metadata LTV, plus whole struct bt_bap_bass_subgroup records for each subgroup beyond CONFIG_BT_BAP_BASS_MAX_SUBGROUPS. This is memory corruption of adjacent Bluetooth-audio state reachable with no pairing, bonding or GATT connection, with a potential for remote code execution in the Bluetooth RX thread; in addition, the unvalidated metadata_len is forwarded to bt_bap_scan_delegator_mod_src(), which neither clamps it nor rejects it, leading to a further copy into the receive state and to out-of-bounds memory being disclosed in the BASS receive-state notification sent to a connected Broadcast Assistant. The fix rejects a BASE carrying more subgroups than the receive state can hold (discarding the update entirely) and omits metadata that does not fit rather than copying it, and additionally honours the previously-ignored error return of the subgroup decode pass.
Title Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state
Weaknesses CWE-120
CWE-787
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-10-09T17:58:32.024Z

Reserved: 2026-08-11T19:15:06.116Z

Link: CVE-2026-19570

cve-icon Vulnrichment

Updated: 2026-10-09T17:58:21.609Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-09T08:16:54.693

Modified: 2026-10-09T18:17:07.887

Link: CVE-2026-19570

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T09:00:03Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-787

    Out-of-bounds Write