CVE-2026-19570 in Zephyr
Summary
by MITRE • 10/09/2026
The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base_subgroup_meta_cb() the destination element was selected as mod_src_param.subgroups[mod_src_param.num_subgroups] with no test against ARRAY_SIZE(mod_src_param.subgroups) (sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, default 1), and the metadata was copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to ~24 subgroups and metadata LTVs of ~240 octets.
The defect is reached from the periodic advertising receive callback: pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). Every broadcast sink registers a scan-delegator receive state at creation (bt_bap_broadcast_sink_create() calls broadcast_sink_add_src()), and CONFIG_BT_BAP_BROADCAST_SINK depends on CONFIG_BT_BAP_SCAN_DELEGATOR, so the path is active in every broadcast-sink build once the device is periodic-advertising-synced. An attacker in radio range who operates a broadcast source the device syncs to — or who impersonates the advertiser address and SID of one already in use, periodic advertising data being unauthenticated — can change the BASE at will; each new BASE is re-parsed.
A crafted BASE therefore writes attacker-chosen bytes past the end of a fixed static object in .bss: up to roughly 236 bytes for an oversized metadata LTV, plus whole struct bt_bap_bass_subgroup records for each subgroup beyond CONFIG_BT_BAP_BASS_MAX_SUBGROUPS. This is memory corruption of adjacent Bluetooth-audio state reachable with no pairing, bonding or GATT connection, with a potential for remote code execution in the Bluetooth RX thread; in addition, the unvalidated metadata_len is forwarded to bt_bap_scan_delegator_mod_src(), which neither clamps it nor rejects it, leading to a further copy into the receive state and to out-of-bounds memory being disclosed in the BASS receive-state notification sent to a connected Broadcast Assistant.
The fix rejects a BASE carrying more subgroups than the receive state can hold (discarding the update entirely) and omits metadata that does not fit rather than copying it, and additionally honours the previously-ignored error return of the subgroup decode pass.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
This vulnerability represents a critical out-of-bounds write condition within the LE Audio Broadcast Sink implementation in the Zephyr RTOS Bluetooth subsystem. The core technical flaw resides in the base_subgroup_meta_cb function, which processes Basic Audio Announcement (BASE) data received via periodic advertising. When parsing subgroup metadata from an incoming BASE structure, the code selects a destination element within the static mod_src_param.subgroups array using the current count of subgroups without verifying that this index is within the bounds defined by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS. Furthermore, the subsequent memory copy operation utilizes memcpy to transfer data based on the raw length field provided in the advertisement payload, rather than validating it against the maximum allowed metadata size configured by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE. This combination of unchecked array indexing and unvalidated buffer lengths allows an attacker to write arbitrary amounts of data beyond the allocated static memory region located in the .bss segment.
The attack surface is accessible through the periodic advertising receive callback chain, which includes pa_recv, bt_data_parse, pa_decode_base, update_recv_state_base, and finally base_subgroup_meta_cb. This path is active whenever a device with Broadcast Sink capabilities has established synchronization with a periodic advertiser. Because LE Audio periodic advertisements are unauthenticated by default, an attacker within radio range can craft malicious BASE structures or impersonate legitimate advertisers to inject these malformed packets. The internal validator bt_bap_base_get_base_from_ad() performs only structural consistency checks and permits up to approximately twenty-four subgroups and metadata Length-Value-Type fields of roughly two hundred forty octets each. Consequently, the system fails to detect oversized payloads before they are processed by the vulnerable callback function, leading directly to memory corruption.
The operational impact of this vulnerability is severe, encompassing both confidentiality and integrity risks alongside potential remote code execution. The out-of-bounds write corrupts adjacent Bluetooth-audio state structures in static memory without requiring any prior pairing, bonding, or GATT connection. This lack of authentication requirement makes the attack vector particularly dangerous for public-facing audio services. In a worst-case scenario, an attacker could overwrite critical control flow data or function pointers within the corrupted memory region, leading to arbitrary code execution within the Bluetooth receive thread context. Additionally, because the unvalidated metadata length is forwarded to bt_bap_scan_delegator_mod_src without clamping, further out-of-bounds reads can occur when this state is eventually communicated to a connected Broadcast Assistant application via BASS notifications, resulting in information disclosure of sensitive internal system data.
Mitigation strategies involve applying vendor-provided patches that enforce strict bounds checking during the parsing phase. The corrected implementation rejects any BASE structure containing more subgroups than the receive state can accommodate, thereby discarding the entire update rather than processing partial or corrupted data. It also ensures that metadata is only copied if it fits within the configured maximum size limits, preventing buffer overflows at the copy stage. Furthermore, proper error handling has been implemented to respect return codes from subgroup decoding passes, ensuring that malformed inputs are not silently ignored. To reduce risk in environments where security is paramount, administrators should consider disabling periodic advertising synchronization for Broadcast Sink roles if they are not strictly required, or implementing network-level filtering to restrict which advertisers the device can sync with. This vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write, and its exploitation via unauthenticated wireless input relates to ATT&CK techniques involving remote code execution through peripheral devices.