Technical impact
An integer underflow in bt_mesh_sol_recv() causes an out‑of‑bounds write during solicitation PDU parsing. The underflow allows an attacker to craft a length byte smaller than three, leading the code to compute a negative value that wraps into an enormous size_t when passed to net_buf_simple_pull_mem(). This causes the buffer pointer to advance beyond the allocated memory, resulting in invalid memory accesses that can be exploited for denial of service or arbitrary code execution. The vulnerability can be triggered by sending a non‑connectable BLE advertisement containing a crafted UUID16 AD structure, with no pairing or prior association required.
Affected Systems
Zephyr Project's Zephyr RTOS, specifically the Bluetooth Mesh sub‑system when CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled. No specific version ranges are listed in the advisory; the issue applies to any build including that configuration.
Risk and Exploitability
The CVSS score is 6.3, indicating moderate severity; the EPSS score is less than 1%, implying a very low exploitation likelihood. The vulnerability is publicly known and exploited only via BLE advertisements, which are easily transmitted by any nearby BLE device. Because the attack does not require credentials or prior configuration, an attacker can affect any device running the affected Zephyr code. The lack of a KEV listing suggests current exploitation may not yet be widespread, but the theoretical impact warrants immediate attention.
