Description
The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer.

The OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_command_decode() accepts the Calculate Checksum op code unconditionally (it is not guarded by CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT), builds without checksum support are reachable too: they answer BT_GATT_OTS_OACP_RES_OPCODE_NOT_SUP and take the same bad path.

On builds with CONFIG_ASSERT enabled, the zero-length pull trips the assertion inside net_buf_simple_pull_mem() and panics the device, giving a remotely triggered denial of service. On builds with assertions disabled there is no check: the pull returns the untouched stack array and four bytes of uninitialized stack memory are copied into the indication and transmitted to the peer, repeatable on every request. The disclosure is bounded to four bytes per request and the write stays inside the seven-byte res indication buffer, so there is no memory corruption; the impact is uninitialized-memory disclosure plus an availability loss in assertion-enabled configurations.
Published: 2026-10-26
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Information Disclosure and Denial of Service
Action: Patch
AI Analysis

Impact

The Zephyr OTS server wrongly appends a four‑byte Checksum Value field to the OACP response even when the Calculate Checksum command fails. The buffer used for the checksum is uninitialized; on success it is filled, but on every failure path it remains empty. When the response is transmitted, four bytes of stack memory are copied to the indication and sent to the peer. No memory corruption occurs, but the data leaked can reveal internal state. On builds where CONFIG_ASSERT is enabled, the same zero‑length pull triggers an assertion and causes the device to panic, providing a remote denial of service. The disclosure is limited to four bytes per request, but can be repeated whenever a client issues a failing Calculate Checksum command. The vulnerability is triggered by any peer that can connect to the device and perform the OACP interaction. The GATT permissions for the OACP characteristic and its CCCD are BT_GATT_PERM_WRITE and BT_GATT_PERM_READ|BT_GATT_PERM_WRITE, meaning no pairing, encryption, or authentication is required; any device within radio range can exploit it. The CVSS score of 7.1 marks the issue as High. EPSS data are not available, and the bug is not listed in the CISA KEV catalog. Attackers do not need privileged credentials – they simply need to send a Calculate Checksum request that fails validation and enable OACP indications – making the exploit straightforward over Bluetooth radio. By exploiting the flaw, an attacker can repeatedly read four bytes of uninitialized memory and, on assertion‑enabled builds, crash the device. The impact affects confidentiality through memory disclosure and availability through potential device resets.

Affected Systems

Affected system: Zephyr RTOS released by Zephyr Project. The vulnerability exists in the Zephyr OTS server component and applies to any device running Zephyr that has the OACP service enabled. No specific version information is provided in the advisory; the issue is based on the upstream code as of the referenced commit. Systems that incorporate the OTS server and permit OACP indications without authentication are vulnerable.

Risk and Exploitability

The CVSS score of 7.1 marks the issue as High. EPSS data are not available, and the bug is not listed in the CISA KEV catalog. Attackers do not need privileged credentials – they simply need to send a Calculate Checksum request that fails validation and enable OACP indications – making the exploit straightforward over Bluetooth radio. By exploiting the flaw, an attacker can repeatedly read four bytes of uninitialized memory and, on assertion‑enabled builds, crash the device. The impact affects confidentiality through memory disclosure and availability through potential device resets.

Generated by OpenCVE AI on October 26, 2026 at 18:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Zephyr to the latest patched revision (commit 36145a6f1164e2e0a18c8c83d5b1be6e7d3f6e23) or apply the security advisory patch GHSA-7c9w-mhqw-5g86.
  • Rebuild your project with the updated source and deploy the firmware to all affected devices.
  • If immediate patching cannot be performed, enable CONFIG_ASSERT in the build configuration and limit OTS interactions to authenticated connections or disable the OACP service until the patch is applied.

Generated by OpenCVE AI on October 26, 2026 at 18:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c). Before this fix the four-byte Checksum Value field was appended whenever the requested op code was BT_GATT_OTS_OACP_PROC_CHECKSUM_CALC, regardless of the result code. The response payload is a bare, uninitialized four-byte stack buffer declared with NET_BUF_SIMPLE_DEFINE(resp_param, sizeof(uint32_t)) in bt_gatt_ots_oacp_write(), and it is filled only on the success path of oacp_checksum_proc_validate(). On every failure path the buffer is still empty, so net_buf_simple_pull_le32() was invoked on a zero-length buffer. The OACP characteristic and its client characteristic configuration descriptor are declared with BT_GATT_PERM_WRITE and BT_GATT_PERM_READ | BT_GATT_PERM_WRITE, so no pairing, encryption, or authentication is required. Any peer within radio range that can connect to a device running the OTS server can enable OACP indications and write a nine-byte Calculate Checksum command that fails validation — for example by issuing it with no object selected, which returns BT_GATT_OTS_OACP_RES_INV_OBJ. Because oacp_command_decode() accepts the Calculate Checksum op code unconditionally (it is not guarded by CONFIG_BT_OTS_OACP_CHECKSUM_SUPPORT), builds without checksum support are reachable too: they answer BT_GATT_OTS_OACP_RES_OPCODE_NOT_SUP and take the same bad path. On builds with CONFIG_ASSERT enabled, the zero-length pull trips the assertion inside net_buf_simple_pull_mem() and panics the device, giving a remotely triggered denial of service. On builds with assertions disabled there is no check: the pull returns the untouched stack array and four bytes of uninitialized stack memory are copied into the indication and transmitted to the peer, repeatable on every request. The disclosure is bounded to four bytes per request and the write stays inside the seven-byte res indication buffer, so there is no memory corruption; the impact is uninitialized-memory disclosure plus an availability loss in assertion-enabled configurations.
Title Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses
Weaknesses CWE-617
CWE-908
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-10-26T17:37:11.149Z

Reserved: 2026-08-26T15:37:51.472Z

Link: CVE-2026-81038

cve-icon Vulnrichment

Updated: 2026-10-26T17:35:39.451Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T17:17:30.350

Modified: 2026-10-26T18:34:17.050

Link: CVE-2026-81038

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T18:15:14Z

Weaknesses