Out of Bounds Write Vulnerability in Zephyr RTOS by Zephyr Project

CVE-2025-9558

What is CVE-2025-9558?

The Zephyr RTOS contains an Out of Bounds (OOB) Write vulnerability in the gen_prov_start function located in pb_adv.c. This vulnerability arises because the function copies the full length of incoming data into the link.rx.buf receiver buffer without performing adequate validation on the data's size. As a result, this flaw could potentially lead to a buffer overflow, allowing attackers to exploit the system and execute arbitrary code. It is crucial for users of affected versions to review their implementations and apply necessary patches as outlined in the security advisory.

References