zephyrproject-rtos Zephyr up to 4.4.0 SDP Parser sdp.c bt_sdp_parse_attribute out-of-bounds

Summaryinfo

A vulnerability was found in zephyrproject-rtos Zephyr up to 4.4.0. It has been classified as problematic. Impacted is the function bt_sdp_parse_attribute of the file subsys/bluetooth/host/classic/sdp.c of the component SDP Parser. The manipulation leads to out-of-bounds. This vulnerability is traded as CVE-2026-10651. Access to the local network is required for this attack to succeed. There is no exploit available.

Detailsinfo

A vulnerability was found in zephyrproject-rtos Zephyr up to 4.4.0 and classified as critical. This issue affects the function bt_sdp_parse_attribute of the file subsys/bluetooth/host/classic/sdp.c of the component SDP Parser. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the data-element descriptor (type), via net_buf_simple_pull_u8(). Because net_buf_simple_pull_u8() dereferences buf->data[0] before its only bounds guard (an __ASSERT_NO_MSG that compiles out when CONFIG_ASSERT is disabled, the production default), a record of exactly three bytes (0x09 followed by a 2-byte attribute ID) causes a one-byte read past the end of the logical buffer. The parser is reachable from inbound, remote-controlled data: a Bluetooth BR/EDR peer acting as an SDP server returns discovery-response records that are stored verbatim in the client receive buffer and parsed via the public bt_sdp_get_attr()/bt_sdp_has_attr()/bt_sdp_record_parse() helpers. The over-read is bounded to a single byte that is used only as an internal length selector and is never leaked to the attacker; subsequent length checks then reject the malformed record. Realistic impact is therefore limited to an edge-case denial of service (a fault only if the record ends exactly at a mapped-memory boundary, or a deterministic assert panic when CONFIG_ASSERT=y). Affects Zephyr v4.3.0 and v4.4.0; fixed by adding sizeof(type) to the length check.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-10651 since 06/02/2026. The exploitation is known to be easy. Access to the local network is required for this attack. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 322294 (Linux Distros Unpatched Vulnerability : CVE-2026-10651), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (322294). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• zephyrproject-rtos

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4.0

License

• open-source

Website

• Product: https://github.com/zephyrproject-rtos/zephyr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion