Vulnerabilities

TI-2026-09160 CVE-2026-10658

Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation

LOW 31

bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() withou…

CVSS 3.1HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00282 Published 2026-06-22 Fixed in 4.6.0 CWE-787

TI-2026-09153 CVE-2026-10651

Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)

LOW 31

bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the…

CVSS 3.1HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00298 Published 2026-06-22 Fixed in 4.6.0 CWE-20

TI-2026-09147 CVE-2026-10645

Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image

LOW 24

The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory block.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00158 Published 2026-06-22 Fixed in 4.6.0 CWE-125

Vulnerabilities

Filters

Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation

Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)

Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image