A flaw in the Zephyr Bluetooth controller ISO Adaptation Layer incorrectly treats the length field of a start segment as always valid, even when it is less than the required three bytes. The subtraction of three from an unsigned byte underflows, yielding an inflated length that is then used to copy up to 255 bytes of memory beyond the received packet into an HCI ISO data packet. The data copied is controlled by the attacker and can expose sensitive controller memory to the host, and the malformed packets can cause a crash or other denial‑of‑service behavior.

Zephyr RTOS The vulnerability affects the Bluetooth controller implementation in Zephyr, and all releases that introduced framed ISO reception, namely versions starting with 3.0.0. It applies to any device running Zephyr with the default ISO AccInput Layer enabled, regardless of vendor customization.

The CVSS score of 6.5 indicates a moderate to high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can trigger the flaw over the air via IEEE 802.15.1 CIS or BIS sync channels, as well as the vendor data path, without requiring privileged access on the device. By sending crafted ISO PDUs the attacker can read up to 255 bytes of adjacent memory, potentially leaking internal state or causing a crash. The remote nature of the attack vector and the absence of a required local privilege elevate the risk to operational environments that rely on Zephyr for Bluetooth connectivity.