zephyrproject-rtos Zephyr up to 4.4.0 SDP Parser sdp.c bt_sdp_parse_attribute out-of-bounds

Summaryinfo

A vulnerability was found in zephyrproject-rtos Zephyr up to 4.4.0. It has been classified as problematic. Impacted is the function bt_sdp_parse_attribute of the file subsys/bluetooth/host/classic/sdp.c of the component SDP Parser. The manipulation leads to out-of-bounds. This vulnerability is traded as CVE-2026-10651. Access to the local network is required for this attack to succeed. There is no exploit available.

Detailsinfo

A vulnerability was found in zephyrproject-rtos Zephyr up to 4.4.0 and classified as critical. This issue affects the function bt_sdp_parse_attribute of the file subsys/bluetooth/host/classic/sdp.c of the component SDP Parser. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In subsys/bluetooth/host/classic/sdp.c, bt_sdp_parse_attribute() accepts an input buffer once it contains the 1-byte attribute type and 2-byte attribute id, but then unconditionally pulls an additional byte for the value type without verifying that the byte is present. A truncated 3-byte attribute (for example 09 00 09) therefore reaches net_buf_simple_pull() with insufficient remaining length, triggering the __ASSERT_NO_MSG(buf->len >= len) check and a kernel panic in assert-enabled builds (denial of service). In builds where assertions are disabled, parsing may continue past the end of the available buffer, leading to an out-of-bounds read and undefined behavior.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-10651 since 06/02/2026. The exploitation is known to be easy. Access to the local network is required for this attack. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 322294 (Linux Distros Unpatched Vulnerability : CVE-2026-10651), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (322294). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• zephyrproject-rtos

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4.0

License

• open-source

Website

• Product: https://github.com/zephyrproject-rtos/zephyr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion